From 16998a1aae9ef3260f2a962b73c4e554eb200948 Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 10:35:39 -0700 Subject: [PATCH 1/4] chore(cla): call the shared CLA reusable instead of a self-hosted job (ENG-2017) The CLA check ran on mdb-dev, a pod inside the newdev cluster. Its triggers, pull_request_target and issue_comment, both run in base-repo context, so GitHub's fork-approval gate never applied and any account could start that pod by opening a pull request or leaving a comment. Replace the hand-rolled job with the reusable anton, cowork and cowork-server already call. It runs on ubuntu-latest, pins the third-party action to a commit, grants actions read rather than write, and skips the job outright for a comment that is not a CLA comment. Refs: ENG-2017 --- .github/workflows/cla.yml | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 99dad50..9532fdf 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -1,27 +1,21 @@ name: "MindsDB CLA Assistant" + +permissions: + actions: read + contents: write + pull-requests: write + statuses: write + on: issue_comment: types: [created] pull_request_target: types: [opened,closed,synchronize] -permissions: - actions: write - contents: write - pull-requests: write - statuses: write - jobs: CLAssistant: - runs-on: mdb-dev - steps: - - name: "CLA Assistant" - if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target' - uses: contributor-assistant/github-action@v2.6.1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - path-to-signatures: 'assets/contributions-agreement/cla.json' - path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md' - branch: 'cla' - allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, tmichaeldb, dusvyat, hamishfagg, MinuraPunchihewa, martyna-mindsdb, lucas-koontz + uses: mindsdb/github-actions/.github/workflows/cla-assistant.yml@main + with: + path-to-signatures: 'assets/contributions-agreement/cla.json' + path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md' + allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, tmichaeldb, dusvyat, hamishfagg, MinuraPunchihewa, martyna-mindsdb, lucas-koontz From 04553ec3e83a39f25d3c908bac718b07adfb4414 Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 14:32:01 -0700 Subject: [PATCH 2/4] fix(cla): point the agreement link at the canonical repository (ENG-2017) Both URLs the org uses for this document are rename redirects that resolve to the same repository and serve byte-identical content. A redirect is fine until somebody creates a repository at the old name, and this is the page a contributor reads before agreeing to it. Name the repository that actually holds the file. Refs: ENG-2017 --- .github/workflows/cla.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 9532fdf..038d3ed 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -17,5 +17,5 @@ jobs: uses: mindsdb/github-actions/.github/workflows/cla-assistant.yml@main with: path-to-signatures: 'assets/contributions-agreement/cla.json' - path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md' + path-to-document: 'https://github.com/mindsdb/mindshub/blob/main/assets/contributions-agreement/individual-contributor.md' allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, tmichaeldb, dusvyat, hamishfagg, MinuraPunchihewa, martyna-mindsdb, lucas-koontz From 5fa870fde775c4f489fa1bc8f41824316a8a6bb0 Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 17:16:30 -0700 Subject: [PATCH 3/4] chore(cla): stop passing an allowlist, the reusable owns it now (ENG-2017) The allowlist moved into mindsdb/github-actions and is bots only. This repo carried one of six hand-maintained copies naming people, and 11 of the 25 names across those copies had already left the org while still being exempt from signing. Staff sign like everybody else now. A bot cannot sign, so the two that actually open pull requests in this org stay exempt in the reusable. Dropping the line also drops two defects that rode inside it. `bot*` compiled to an unanchored `new RegExp("bot.*").test(login)`, so it exempted any login containing "bot", `robotnik` and `sabotage` included. And `Stpmax` never matched the real login `StpMax`, because non-wildcard entries are compared with a case-sensitive `===`. Needs mindsdb/github-actions#56 first, which gives the input a default. --- .github/workflows/cla.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 038d3ed..d88cf7f 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -18,4 +18,3 @@ jobs: with: path-to-signatures: 'assets/contributions-agreement/cla.json' path-to-document: 'https://github.com/mindsdb/mindshub/blob/main/assets/contributions-agreement/individual-contributor.md' - allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, tmichaeldb, dusvyat, hamishfagg, MinuraPunchihewa, martyna-mindsdb, lucas-koontz From 97d38aaa2c5be4233c3d0c9ff6bb4ea548a917f6 Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 17:18:33 -0700 Subject: [PATCH 4/4] chore(ci): require DevOps review on .github/ (ENG-2017) This repo accepts pull requests from outside contributors and had no CODEOWNERS at all, so a workflow change here needed no particular reviewer. Everything under .github/ decides what runs in CI, on which runner, and with which secrets in scope, which is a trust boundary rather than product code. Auto-request only for now. Making it a hard gate needs require_code_owner_reviews in branch protection, which this repo does not have; that rides ENG-2013's org ruleset. --- .github/CODEOWNERS | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..7a7c12f --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,5 @@ +# Everything under .github/ decides what runs in CI, on which runner, and with +# which secrets in scope. This repo accepts pull requests from outside +# contributors, so a change here is a change to a trust boundary rather than to +# the product. DevOps reviews it. +.github/ @mindsdb/devops