From c54040c6148e1c27344deb7aa6776d5fe579ff1c Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Jan 2026 21:28:00 +0000 Subject: [PATCH 1/3] Update CLA action to store signatures on IMPT_cla_signatures branch Change the branch parameter from 'main' to 'IMPT_cla_signatures' for storing CLA signature data. --- .github/workflows/cla.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index b48edd27..1cd30b03 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -28,7 +28,7 @@ jobs: path-to-signatures: '.github/CLA_SIGNATORIES.json' path-to-document: 'https://github.com/${{ github.repository }}/blob/main/CLA.md' # Branch where CLA signatures will be stored - branch: 'main' + branch: 'IMPT_cla_signatures' allowlist: 'dependabot[bot],github-actions[bot]' # Customizable messages From e4e86e3917abd97d9b7968340313d1314673aa26 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Jan 2026 21:32:05 +0000 Subject: [PATCH 2/3] Reorganize CLA files into CLA/version_1 directory - Move CLA.md to CLA/version_1/CLA.md - Move .github/CLA_SIGNATORIES.md to CLA/version_1/CLA_SIGNATORIES.md - Update all references in: - .github/workflows/cla.yml - .github/CLA_SETUP.md - README.md - CONTRIBUTING.md - CLA.md (self-references) - CLA_SIGNATORIES.md (relative links) --- .github/CLA_SETUP.md | 12 ++++++------ .github/workflows/cla.yml | 4 ++-- CLA.md => CLA/version_1/CLA.md | 2 +- {.github => CLA/version_1}/CLA_SIGNATORIES.md | 2 +- CONTRIBUTING.md | 6 +++--- README.md | 2 +- 6 files changed, 14 insertions(+), 14 deletions(-) rename CLA.md => CLA/version_1/CLA.md (98%) rename {.github => CLA/version_1}/CLA_SIGNATORIES.md (91%) diff --git a/.github/CLA_SETUP.md b/.github/CLA_SETUP.md index 4c1541b1..a43a4966 100644 --- a/.github/CLA_SETUP.md +++ b/.github/CLA_SETUP.md @@ -6,7 +6,7 @@ This document explains how to set up the CLA Assistant GitHub Action to automati The CLA Assistant GitHub Action (`.github/workflows/cla.yml`) automatically: - Comments on new pull requests asking contributors to sign the CLA -- Tracks who has signed the CLA in `.github/CLA_SIGNATORIES.json` +- Tracks who has signed the CLA in `CLA/version_1/CLA_SIGNATORIES.md` - Updates PR status checks based on CLA signature status - Allows contributors to sign by commenting on their PR @@ -65,7 +65,7 @@ To verify the CLA Assistant is working: I have read the CLA Document and I hereby sign the CLA ``` -4. **Verify signature tracking**: After signing, a new commit should be added to the main branch updating `.github/CLA_SIGNATORIES.json` +4. **Verify signature tracking**: After signing, a new commit should be added to the main branch updating `CLA/version_1/CLA_SIGNATORIES.md` 5. **Check PR status**: The PR status check should update to show "All contributors have signed the CLA ✅" @@ -76,15 +76,15 @@ To verify the CLA Assistant is working: When a contributor opens a pull request: 1. The CLA Assistant bot comments with a link to the CLA and instructions -2. The contributor reads the CLA at `/CLA.md` +2. The contributor reads the CLA at `/CLA/version_1/CLA.md` 3. The contributor signs by commenting: `I have read the CLA Document and I hereby sign the CLA` -4. The bot records the signature in `.github/CLA_SIGNATORIES.json` +4. The bot records the signature in `CLA/version_1/CLA_SIGNATORIES.md` 5. The bot updates the PR status to indicate CLA is signed 6. Future PRs from the same contributor don't require re-signing ### Signature Storage -Signatures are stored in `.github/CLA_SIGNATORIES.json` in the following format: +Signatures are stored in `CLA/version_1/CLA_SIGNATORIES.md` in the following format: ```json { @@ -160,7 +160,7 @@ Recommended rotation period: Every 12 months - [CLA Assistant GitHub Action Documentation](https://github.com/contributor-assistant/github-action) - [GitHub Personal Access Tokens Guide](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) -- [DeepWork CLA](../CLA.md) +- [DeepWork CLA](../CLA/version_1/CLA.md) - [DeepWork License](../LICENSE.md) ## Support diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 1cd30b03..d0c330f0 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -25,8 +25,8 @@ jobs: # This should be a Personal Access Token with repo scope PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_ASSISTANT_PAT }} with: - path-to-signatures: '.github/CLA_SIGNATORIES.json' - path-to-document: 'https://github.com/${{ github.repository }}/blob/main/CLA.md' + path-to-signatures: 'CLA/version_1/CLA_SIGNATORIES.md' + path-to-document: 'https://github.com/${{ github.repository }}/blob/main/CLA/version_1/CLA.md' # Branch where CLA signatures will be stored branch: 'IMPT_cla_signatures' allowlist: 'dependabot[bot],github-actions[bot]' diff --git a/CLA.md b/CLA/version_1/CLA.md similarity index 98% rename from CLA.md rename to CLA/version_1/CLA.md index c03df40f..1472c8ee 100644 --- a/CLA.md +++ b/CLA/version_1/CLA.md @@ -102,7 +102,7 @@ By signing this Agreement, You accept and agree to the terms and conditions cont ### For Individual Contributors -To sign this CLA, please add your GitHub username to the list of signatories by creating a pull request that adds your name to the `.github/CLA_SIGNATORIES.md` file, or alternatively, sign the CLA through our automated CLA Assistant when you submit your first pull request. +To sign this CLA, please add your GitHub username to the list of signatories by creating a pull request that adds your name to the `CLA/version_1/CLA_SIGNATORIES.md` file, or alternatively, sign the CLA through our automated CLA Assistant when you submit your first pull request. When you submit a pull request, the CLA Assistant bot will automatically check if you have signed the CLA and guide you through the process if you haven't. diff --git a/.github/CLA_SIGNATORIES.md b/CLA/version_1/CLA_SIGNATORIES.md similarity index 91% rename from .github/CLA_SIGNATORIES.md rename to CLA/version_1/CLA_SIGNATORIES.md index a01151ce..36f2a802 100644 --- a/.github/CLA_SIGNATORIES.md +++ b/CLA/version_1/CLA_SIGNATORIES.md @@ -24,4 +24,4 @@ Organizations that have signed the Corporate CLA are tracked separately. If you --- -For questions about the CLA, see [CLA.md](../CLA.md) or contact legal@unsupervised.com. +For questions about the CLA, see [CLA.md](CLA.md) or contact legal@unsupervised.com. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 731d1f5e..5c77b743 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -39,7 +39,7 @@ The CLA ensures that: **For First-Time Contributors:** 1. **Submit your pull request** - When you open your first PR, the CLA Assistant bot will automatically comment on it -2. **Read the CLA** - Review the [Contributor License Agreement (CLA)](CLA.md) +2. **Read the CLA** - Review the [Contributor License Agreement (CLA)](CLA/version_1/CLA.md) 3. **Sign electronically** - Comment on your PR with: `I have read the CLA Document and I hereby sign the CLA` 4. **Verification** - The bot will verify your signature and update the PR status @@ -57,7 +57,7 @@ Our CLA: - Acknowledges the Business Source License 1.1 restrictions - Is based on the Apache Software Foundation's CLA with modifications for BSL 1.1 -For the full text, see [CLA.md](CLA.md). +For the full text, see [CLA.md](CLA/version_1/CLA.md). ## Development Setup @@ -524,7 +524,7 @@ echo $NIX_PATH By contributing to DeepWork, you agree that your contributions will be licensed under the project's current license. The licensor (Unsupervised.com, Inc.) reserves the right to change the project license at any time at its sole discretion. -You must sign the [Contributor License Agreement (CLA)](CLA.md) before your contributions can be accepted. See the CLA section above for details. +You must sign the [Contributor License Agreement (CLA)](CLA/version_1/CLA.md) before your contributions can be accepted. See the CLA section above for details. --- diff --git a/README.md b/README.md index 1fa7f14a..8bbbb12d 100644 --- a/README.md +++ b/README.md @@ -266,7 +266,7 @@ DeepWork is licensed under the Business Source License 1.1 (BSL 1.1). See [LICEN - **Free for non-competing use**: You can use DeepWork freely for internal workflow automation, education, research, and development - **Change Date**: On January 14, 2030, the license will automatically convert to Apache License 2.0 - **Prohibited Uses**: You cannot use DeepWork to build products that compete with DeepWork or Unsupervised.com, Inc. in workflow automation or data analysis -- **Contributing**: Contributors must sign our [Contributor License Agreement (CLA)](CLA.md) +- **Contributing**: Contributors must sign our [Contributor License Agreement (CLA)](CLA/version_1/CLA.md) For commercial use or questions about licensing, please contact legal@unsupervised.com From cf5a063c3e3aeec7f54fc3d6e7be61881c3877e3 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Jan 2026 21:32:44 +0000 Subject: [PATCH 3/3] Remove CLA_SETUP.md --- .github/CLA_SETUP.md | 171 ------------------------------------------- 1 file changed, 171 deletions(-) delete mode 100644 .github/CLA_SETUP.md diff --git a/.github/CLA_SETUP.md b/.github/CLA_SETUP.md deleted file mode 100644 index a43a4966..00000000 --- a/.github/CLA_SETUP.md +++ /dev/null @@ -1,171 +0,0 @@ -# CLA Assistant Setup Guide - -This document explains how to set up the CLA Assistant GitHub Action to automatically enforce Contributor License Agreement (CLA) signing for all pull requests. - -## Overview - -The CLA Assistant GitHub Action (`.github/workflows/cla.yml`) automatically: -- Comments on new pull requests asking contributors to sign the CLA -- Tracks who has signed the CLA in `CLA/version_1/CLA_SIGNATORIES.md` -- Updates PR status checks based on CLA signature status -- Allows contributors to sign by commenting on their PR - -## Prerequisites - -To enable CLA enforcement, a repository administrator must create a Personal Access Token (PAT) with appropriate permissions. - -## Setup Instructions - -### 1. Create a Personal Access Token (PAT) - -The CLA Assistant needs a PAT to commit signature data back to the repository. - -**Steps:** - -1. Go to GitHub Settings → Developer settings → Personal access tokens → Fine-grained tokens - - URL: https://github.com/settings/tokens?type=beta - -2. Click **"Generate new token"** - -3. Configure the token: - - **Token name**: `CLA Assistant - DeepWork` - - **Expiration**: Choose appropriate expiration (recommend 1 year, then renew) - - **Repository access**: Select "Only select repositories" and choose `Unsupervisedcom/deepwork` - -4. Under **"Permissions"**, configure **Repository permissions**: - - **Contents**: Read and write (required to commit signatures) - - **Pull requests**: Read and write (required to comment and update status) - - **Metadata**: Read-only (automatically selected) - -5. Click **"Generate token"** and **copy the token** (you won't be able to see it again) - -### 2. Add the PAT to Repository Secrets - -1. Go to the DeepWork repository settings: - - URL: https://github.com/Unsupervisedcom/deepwork/settings/secrets/actions - -2. Click **"New repository secret"** - -3. Add the secret: - - **Name**: `CLA_ASSISTANT_PAT` - - **Value**: Paste the PAT you generated in step 1 - -4. Click **"Add secret"** - -### 3. Verify the Setup - -To verify the CLA Assistant is working: - -1. **Create a test pull request** from a different GitHub account (or ask a team member to create one) - -2. **Check for the CLA comment**: The CLA Assistant bot should automatically comment on the PR with instructions to sign the CLA - -3. **Sign the CLA**: Comment on the PR with: - ``` - I have read the CLA Document and I hereby sign the CLA - ``` - -4. **Verify signature tracking**: After signing, a new commit should be added to the main branch updating `CLA/version_1/CLA_SIGNATORIES.md` - -5. **Check PR status**: The PR status check should update to show "All contributors have signed the CLA ✅" - -## How It Works - -### For Contributors - -When a contributor opens a pull request: - -1. The CLA Assistant bot comments with a link to the CLA and instructions -2. The contributor reads the CLA at `/CLA/version_1/CLA.md` -3. The contributor signs by commenting: `I have read the CLA Document and I hereby sign the CLA` -4. The bot records the signature in `CLA/version_1/CLA_SIGNATORIES.md` -5. The bot updates the PR status to indicate CLA is signed -6. Future PRs from the same contributor don't require re-signing - -### Signature Storage - -Signatures are stored in `CLA/version_1/CLA_SIGNATORIES.md` in the following format: - -```json -{ - "signedContributors": [ - { - "name": "username", - "id": 12345678, - "comment_id": 987654321, - "created_at": "YYYY-MM-DDTHH:MM:SSZ", - "repoId": 123456789, - "pullRequestNo": 42 - } - ] -} -``` - -This file is automatically created and updated by the CLA Assistant. - -## Troubleshooting - -### CLA Assistant Not Commenting on PRs - -**Possible causes:** -- The `CLA_ASSISTANT_PAT` secret is not set or has expired -- The PAT doesn't have the required permissions -- The workflow file has syntax errors - -**Solutions:** -1. Check that the secret exists in repository settings -2. Verify PAT permissions (Contents: write, Pull requests: write) -3. Check the Actions tab for workflow errors - -### Signatures Not Being Recorded - -**Possible causes:** -- The PAT doesn't have write access to Contents -- Branch protection rules prevent the bot from committing - -**Solutions:** -1. Verify the PAT has "Contents: Read and write" permission -2. Check branch protection rules and add the CLA Assistant as an exception if needed - -### Contributor Signed But Status Still Shows Unsigned - -**Possible causes:** -- The comment text was not exact -- The workflow didn't trigger - -**Solutions:** -1. Ensure the comment is exactly: `I have read the CLA Document and I hereby sign the CLA` -2. Try commenting `recheck` to trigger the workflow again -3. Check the Actions tab to see if the workflow ran - -## Allowlist - -The following accounts are automatically exempt from CLA requirements: -- `dependabot[bot]` -- `github-actions[bot]` - -To add more accounts to the allowlist, edit `.github/workflows/cla.yml` and update the `allowlist` field. - -## Token Rotation - -For security, rotate the PAT periodically: - -1. Generate a new PAT following the steps above -2. Update the `CLA_ASSISTANT_PAT` secret with the new token -3. Delete the old PAT from GitHub settings - -Recommended rotation period: Every 12 months - -## Additional Resources - -- [CLA Assistant GitHub Action Documentation](https://github.com/contributor-assistant/github-action) -- [GitHub Personal Access Tokens Guide](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) -- [DeepWork CLA](../CLA/version_1/CLA.md) -- [DeepWork License](../LICENSE.md) - -## Support - -For questions or issues with CLA setup, please: -- Open an issue in the repository -- Contact the repository administrators -- Email legal@unsupervised.com for legal questions about the CLA