From de10bf1f5ac08606871f84edd726aaa04cf18cae Mon Sep 17 00:00:00 2001 From: Massimiliano Meneghin Date: Mon, 5 Oct 2026 17:36:58 +0000 Subject: [PATCH] ci(cla): authenticate CLA Assistant via the CLA Signatures GitHub App The CLA check has been failing on every PR with "Could not retrieve repository contents: Bad credentials. Status: 401" because the CLA_BOT_SECRET PAT is expired or revoked. Per the Autodesk OSSA runbook, the supported mechanism is now the cla-signatures GitHub App rather than a personal access token. - Mint an installation token with actions/create-github-app-token, scoped to Autodesk/CLA-Signatures, and pass it as PERSONAL_ACCESS_TOKEN. The app id comes from the vars namespace and the private key from secrets, matching how the runbook says the org-level values are stored. - Upgrade contributor-assistant/github-action from v2.1.3-beta to v2.6.1, clearing the Node 20 deprecation warning. - Refresh two comments that described the old PAT mechanism. Requires the org-level CLA_BOT_APP_ID variable and CLA_BOT_PRIVATE_KEY secret, and the cla-signatures App installed on Autodesk/CLA-Signatures. Takes effect only once merged to main, since pull_request_target and issue_comment load the workflow from the base branch. Co-authored-by: Cursor --- .github/workflows/cla.yml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 535f7dc4..d2daf31e 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -9,14 +9,22 @@ jobs: CLA-Assistant: runs-on: ubuntu-latest steps: + - uses: actions/create-github-app-token@v2 + id: app-token + with: + app-id: ${{ vars.CLA_BOT_APP_ID }} + private-key: ${{ secrets.CLA_BOT_PRIVATE_KEY }} + owner: Autodesk + repositories: | + CLA-Signatures - name: "CLA Assistant" if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target' - # Beta Release - uses: contributor-assistant/github-action@v2.1.3-beta + # v2.6.1 is the final upstream release; the project is archived + uses: contributor-assistant/github-action@v2.6.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # the below token should have repo scope and must be manually added by you in the repository's secret - PERSONAL_ACCESS_TOKEN : ${{ secrets.CLA_BOT_SECRET }} + # installation token for Autodesk/CLA-Signatures, minted by the step above + PERSONAL_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }} with: remote-repository-name: 'CLA-Signatures' remote-organization-name: 'Autodesk'