Skip to content

caa: skip the check for Dependabot PRs #198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rowan-claude merged 1 commit into from
Oct 28, 2026
Merged

caa: skip the check for Dependabot PRs #198

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions .github/workflows/cla.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,10 +114,17 @@ jobs:
# dead: the comment arrives, no `if` matches, the job never starts, and
# the contributor gets no run, no log and no error. It is also the only
# way to clear a red check after a signature is recorded by hand.
# Dependabot (Glenn, 2026-10-27): its PRs skip the CAA. The test is the
# PR's author LOGIN, which GitHub verifies, never a commit author name
# (see `allowlist` below for why a name entry would be a bypass).
# Dependabot branches live in this repository, so only accounts with
# write access can push further commits onto them.
- name: CAA check
if: >-
github.event_name == 'pull_request_target' ||
(github.event_name == 'pull_request_target' &&
github.event.pull_request.user.login != 'dependabot[bot]') ||
(github.event.issue.pull_request != null &&
github.event.issue.user.login != 'dependabot[bot]' &&
(github.event.comment.body == 'I have read the CAA and I hereby sign it, assigning copyright in my contributions to Más Bandwidth LLC.' ||
github.event.comment.body == 'recheck'))
uses: contributor-assistant/github-action@v2.6.1
Expand All @@ -140,8 +147,9 @@ jobs:
# GitHub and cannot be spoofed. Our agents commit as
# Rowan Claude <305107455+rowan-claude@users.noreply.github.com>,
# which GitHub links to the rowan-claude login. The action always
# skips github-actions[bot] itself (user id 41898282); any other bot,
# dependabot included, is not on this list and fails it. Never add a
# skips github-actions[bot] itself (user id 41898282); any other bot
# is not on this list and fails it (dependabot is skipped by the
# step's condition above, by verified PR author). Never add a
# name or a wildcard here: a red caa check is fixed by committing
# under a linked identity, never by widening this list.
allowlist: gafferongames,rowan-claude
Expand Down
Loading