From a8cb548a87022bdf83f8c2d21ca42c485d70503f Mon Sep 17 00:00:00 2001 From: martyna-mindsdb Date: Tue, 8 Sep 2026 18:16:23 +0200 Subject: [PATCH 1/3] fix: correct snyk-bot login in CLA allowlist (was snyk-bot[bot]) #63 added snyk-bot to the CLA allowlist but wrote it as `snyk-bot[bot]`. The allowlist match is exact and case-sensitive (this file's own header: `pattern === committer`), and the real committer login on Snyk-authored commits is `snyk-bot`, no [bot] suffix -- confirmed directly from commit data on both mindsdb/anton#443 and mindsdb/cowork#836. Verified the bug is live: triggered a `recheck` on cowork#836 after #63 merged, and it still failed with "Committers ... have to sign the CLA" -- the run's own logs show `allowlist: dependabot[bot], mindsdb-release-train[bot], snyk-bot[bot]`, confirming the suffix is why it doesn't match. Also updated the header comment's now-stale "only the two" to "three", matching #63's intent. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/cla-assistant.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/cla-assistant.yml b/.github/workflows/cla-assistant.yml index 4b00d04..9fc5374 100644 --- a/.github/workflows/cla-assistant.yml +++ b/.github/workflows/cla-assistant.yml @@ -59,9 +59,11 @@ # was a former colleague still exempt from signing. # # Bots stay, because a bot cannot sign: it cannot post the agreement sentence, -# so with no exemption its pull request is red forever. Only the two that -# actually open pull requests here are listed. `github-actions[bot]` needs no -# entry, since the action filters user id 41898282 in `graphql.ts` itself. +# so with no exemption its pull request is red forever. Only the three that +# actually open pull requests here are listed (`snyk-bot` opens automated +# dependency-upgrade PRs across many repos in the org). `github-actions[bot]` +# needs no entry, since the action filters user id 41898282 in `graphql.ts` +# itself. # # Add a bot by editing the default below, not by passing the input. Anything # passed per repo drifts, which is the whole reason this moved. @@ -85,7 +87,7 @@ on: allowlist: description: "Comma-separated logins exempt from signing. Bots only; see the header. Override only for a genuine one-off." type: string - default: 'dependabot[bot], mindsdb-release-train[bot], snyk-bot[bot]' + default: 'dependabot[bot], mindsdb-release-train[bot], snyk-bot' path-to-signatures: description: "Signature ledger path inside the calling repo" type: string From 764cebf1b0eaba4ebbd1ee509bb1c829a32469cb Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Tue, 8 Sep 2026 12:36:10 -0700 Subject: [PATCH 2/3] test(cla): let a machine-user login satisfy the bots-only check `test_every_entry_is_a_bot` used the `[bot]` suffix as its definition of a bot, which held only while every allowlisted account was a GitHub App. Correcting `snyk-bot[bot]` to the login that actually commits, `snyk-bot`, made the list right and the test red: Snyk opens its upgrade PRs from an ordinary account it owns, so GitHub types it "User" and the login has no suffix to check. The guard the test exists for is that no PERSON is exempt from signing, and that survives. Machine accounts GitHub types "User" are named in `MACHINE_USERS`, and an entry now clears the check by carrying the reserved suffix or by appearing there. A human login that nobody named still fails, so exempting a person still means editing a named constant in front of a reviewer rather than picking a username that ends the right way. Relaxing the pattern instead, to something like a trailing `-bot`, would have exempted anyone who registered one. `snyk-bot` joins the logins pinned by `test_the_bots_that_actually_open_pull_requests_stay_exempt`, which is the assertion that was missing: with the exact login pinned, reintroducing `snyk-bot[bot]` fails the suite instead of silently exempting nobody. Lucas Koontz - Unblock the CLA check on Snyk upgrade PRs --- tests/test_cla_allowlist.py | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/tests/test_cla_allowlist.py b/tests/test_cla_allowlist.py index 78ca8fb..5e98a91 100644 --- a/tests/test_cla_allowlist.py +++ b/tests/test_cla_allowlist.py @@ -27,6 +27,16 @@ # weight that reads like a decision. FILTERED_UPSTREAM = "github-actions[bot]" +# `dependabot[bot]` and `mindsdb-release-train[bot]` are GitHub App identities, +# where `[bot]` is part of the login and GitHub reserves it. Snyk instead opens +# its upgrade PRs from an ordinary account it owns, which GitHub reports as type +# "User" (`snyk-bot`, snyk-bot@snyk.io), so that login carries no suffix. +# +# The suffix therefore proves an entry is a bot, but its absence does not prove +# the entry is a person. Every such machine account is named here so the check +# below still fails on a human login that nobody named. +MACHINE_USERS = frozenset({"snyk-bot"}) + def allowlist_default() -> str: spec = yaml.safe_load(_WORKFLOW.read_text(encoding="utf-8")) @@ -59,8 +69,14 @@ def test_every_entry_is_a_bot(): Eleven of the twenty-five names in the old per-repo lists had already left the org and were still exempt. + + An entry clears this either by carrying the reserved `[bot]` suffix or by + being named in `MACHINE_USERS`. Adding a person still means editing that + constant in front of a reviewer, rather than passing a suffix check. """ - assert [e for e in entries() if not e.endswith("[bot]")] == [] + assert [ + e for e in entries() if not e.endswith("[bot]") and e not in MACHINE_USERS + ] == [] def test_github_actions_bot_is_not_listed(): @@ -86,7 +102,14 @@ def action_matches(pattern: str, committer: str) -> bool: assert not any(action_matches(e, impostor) for e in entries()) -@pytest.mark.parametrize("bot", ["dependabot[bot]", "mindsdb-release-train[bot]"]) +@pytest.mark.parametrize( + "bot", ["dependabot[bot]", "mindsdb-release-train[bot]", "snyk-bot"] +) def test_the_bots_that_actually_open_pull_requests_stay_exempt(bot): - """A bot cannot post the agreement sentence, so dropping it means a permanent red check.""" + """A bot cannot post the agreement sentence, so dropping it means a permanent red check. + + The exact login is the assertion. `snyk-bot` was listed as `snyk-bot[bot]` + for a while and exempted nobody, because the action compares + `pattern === committer` and the real committer login has no suffix. + """ assert bot in entries() From 5bb71f26806288dd8718fa829e29058e717541aa Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Tue, 8 Sep 2026 12:37:56 -0700 Subject: [PATCH 3/3] docs(cla): the allowlist matches committers, and snyk-bot opens no pull requests Both descriptions of the allowlist named the wrong axis. The check reads the COMMITTERS of a pull request, and `dependabot[bot]` and `mindsdb-release-train[bot]` happen to be both author and committer of theirs, so "the bots that open pull requests here" described the list correctly by accident. `snyk-bot` breaks that: across every Snyk upgrade PR in the org a human opens the PR and `snyk-bot` is only the committer inside it, so the sentence claiming it opens PRs is wrong on the facts and hides why the entry is needed at all. Such a PR has two committers, and the human still signs. The README also still said two entries were listed and that they were "the only two that open pull requests anywhere in the fleet", which stopped being true when the third was added, and it is the copy a reader reaches first. Both now also record why `snyk-bot` alone carries no `[bot]` suffix: GitHub reserves that suffix for the account it mints alongside a GitHub App, and Snyk commits from an ordinary account it owns. That is the detail whose absence made `snyk-bot[bot]` look right. Lucas Koontz - Unblock the CLA check on Snyk upgrade PRs --- .github/workflows/cla-assistant.yml | 19 ++++++++++++++----- README.md | 13 +++++++++---- 2 files changed, 23 insertions(+), 9 deletions(-) diff --git a/.github/workflows/cla-assistant.yml b/.github/workflows/cla-assistant.yml index 9fc5374..5e6c0b6 100644 --- a/.github/workflows/cla-assistant.yml +++ b/.github/workflows/cla-assistant.yml @@ -59,11 +59,20 @@ # was a former colleague still exempt from signing. # # Bots stay, because a bot cannot sign: it cannot post the agreement sentence, -# so with no exemption its pull request is red forever. Only the three that -# actually open pull requests here are listed (`snyk-bot` opens automated -# dependency-upgrade PRs across many repos in the org). `github-actions[bot]` -# needs no entry, since the action filters user id 41898282 in `graphql.ts` -# itself. +# so with no exemption its pull request is red forever. Three are listed, and +# the check reads COMMITTERS rather than pull request authors. +# `dependabot[bot]` and `mindsdb-release-train[bot]` open their own pull +# requests and commit them. `snyk-bot` opens none: a human opens the Snyk +# upgrade pull request and `snyk-bot` is the committer inside it, so such a PR +# has two committers and the human still signs. +# +# `snyk-bot` is also the one entry with no `[bot]` suffix. GitHub reserves that +# suffix for the account it mints alongside a GitHub App; Snyk commits from an +# ordinary account it owns, which GitHub types "User". Listing it as +# `snyk-bot[bot]` matched nobody, since matching is `pattern === committer`. +# +# `github-actions[bot]` needs no entry, since the action filters user id +# 41898282 in `graphql.ts` itself. # # Add a bot by editing the default below, not by passing the input. Anything # passed per repo drifts, which is the whole reason this moved. diff --git a/README.md b/README.md index 2358e31..cea57bb 100644 --- a/README.md +++ b/README.md @@ -536,10 +536,15 @@ an employment agreement was in place and covered the work. Bots stay, because a bot cannot sign. It cannot post the agreement sentence, so without an exemption its pull request is red forever, and `lightwood` alone has -36 Dependabot pull requests in its last 100. Two are listed, `dependabot[bot]` -and `mindsdb-release-train[bot]`, which are the only two that open pull requests -anywhere in the fleet. `github-actions[bot]` needs no entry: the action already -filters user id 41898282 in `graphql.ts`. +36 Dependabot pull requests in its last 100. Three are listed, and the check +reads committers rather than pull request authors. `dependabot[bot]` and +`mindsdb-release-train[bot]` open their own pull requests and commit them. +`snyk-bot` opens none: a human opens the Snyk upgrade pull request and +`snyk-bot` is the committer inside it, so such a PR has two committers and the +human still signs. `snyk-bot` is also the one entry with no `[bot]` suffix, +because GitHub reserves that suffix for the account it mints alongside a GitHub +App and Snyk commits from an ordinary account it owns. `github-actions[bot]` +needs no entry: the action already filters user id 41898282 in `graphql.ts`. **Never put a `*` in that list.** The action compiles `bot*` to `new RegExp("bot.*")` and calls `.test()`, which is unanchored and searches