Update CLA process to match new requirements from NumFOCUS

[jezdez]

Checklist

• I added a descriptive title
• I searched open issues and couldn't find a duplicate

What?

The CLA process under NumFOCUS will require keeping a .cla_signers file in every repo in the conda organization.

Why?

Here's an excerpt from the new CLA (bold for noting):

In case you're new to CLAs, this is rather standard procedure for larger projects. Django and even Python itself both use something similar.

Process

New contributors should complete the Conda Contributor License Agreement located here. A signed contributor license agreement for a pull request author needs to be on file with NumFOCUS, Inc. for pull requests to be merged. A record of signatories is kept in the .cla-signers file in the project root.

Individual Contributor License Agreement – Conda Code Organization

In order to clarify the intellectual property license granted with Contributions from any person or entity, all projects under the Conda Code Organization (“Conda”) must have a Contributor License Agreement (“Agreement”) on file that has been signed by each Contributor, indicating agreement to the license terms below for each project. This license is for your protection as a Contributor as well as the protection of NumFOCUS, Inc. (“NumFOCUS”) as the legal entity of Conda, and Anaconda, Inc. (“Anaconda”); it does not change your rights to use your own Contributions for any other purpose. This agreement applies to any current and all future Conda projects, including conda, conda-build, constructor, and associated projects under the Conda Code Organization. While currently hosted on GitHub at https://github.com/conda, the project hosting site is subject to change at the sole discretion of Conda’s leadership as stated in their governance.

User impact

Contributors must be able to sign the new CLA only once, enabling them to contribute to any of the projects under the conda organization.

Goals

• Sunset Anaconda CLA process
• Start of NumFOCUS CLA process
• Update the community about the changes

Tasks

• Request old Anaconda CLAs
• Upload Anaconda CLAs to NumFOCUS provided Google Drive
• Get new Adobe Sign account
• Set up new Adobe Sign document @jezdez
• Create a new CLA reviewer sub-team governance#136
• Set up workflow to inform CLA reviewers team (email? github issues?)
• Add Conda Contributor License Agreement to the first level documentation page (or conda.org?) as the new definite information about the CLA @jezdez @kathatherine
• CLA document link needs update conda-docs#931 @kathatherine
• Create conda/cla repo to store CLA legal documents (and version them etc, link back to original files in Google Docs) @jezdez
• On every PR check if the PR author has signed the CLA against a central list of signers (in conda/cla under cla/signers.json) #2 @jezdez @ForgottenProgramme
• Require contributor to sign the PDF hosted under the NumFOCUS Adobe Sign account
• Open a PR in conda/cla that adds the contributor to the central cla/signers.json
  • Automatically assigns the PR to the CLA reviewer team
• Copy the updated cla/signers.json file to all repos under the conda organization
  • The mode of copying can either be push as-is, or by pull via Add template-files composite action actions#127
• Clean out old CLA update PRs
• Write blog post announcing change in process
• Text for the Conda CLA #3

This epic is blocked by:

• Add template-files composite action actions#127
• Create a new CLA reviewer sub-team governance#136

This epic blocks:

• CLA document link needs update conda-docs#931

[jezdez]

@conda/steering-council FYI, I've started to work on this process.

[kathatherine]

Checking in on this @jezdez. The new CLA document that needs to be linked doesn't exist yet, correct?

[jakirkham]

IIUC that is what PR ( #5 ) would do