ci: gate first-time contributor PRs on CLA, sync linked issues, warn on duplicate PRs

[julian-risch]

Related Issues

• Part of https://github.com/deepset-ai/haystack-private/issues/461

Proposed Changes:

Three new workflows:

cla_draft_gate.yml — draft PRs until the CLA is signed. Auto-close after 2 weeks

• Every 30 minutes: open, non-draft PRs from first-time contributors that are older than 1 hour and whose license/cla status isn't green are converted to draft, their requested reviewers removed (remembered in a hidden comment marker), labeled cla-pending, and the contributor gets a friendly explanation.
• When the CLA is signed (license/cla status turns green, on: status trigger), the PR is marked ready for review again and the same individual reviewers are re-requested (not the team, so round-robin doesn't pick someone new). The scheduled sweep is a backstop for missed status events.
• Escalation while a PR stays gated: friendly reminder comment 5 days after the PR was opened, final warning after 10 days ("will be closed as stale in 4 days"), auto-close after 14 days. Each step additionally waits for the previous comment to be a few days old, so PRs that are already old when the workflow first runs get the full reminder sequence instead of being closed immediately. A closed PR can be reopened after signing the CLA and is then automatically marked ready for review.
• Escape hatch: skip-cla-reminder label exempts a PR from reminders and auto-closing.

linked_issue_review.yml — sync linked issues so they read as taken

• When a non-draft PR links an issue (Fixes #123 etc.), the PR's requested reviewers are assigned to the issue — only if nobody is assigned yet — and the issue is moved to ":eyes: In review" in the Open Source project. An assigned, in-review issue signals other contributors and their coding agents that the issue is taken. Helps avoiding duplicate PRs.

pr_flood_guard.yml — warn on duplicates and PR floods

• On newly opened PRs from outside the org: warns in a comment if another open PR already targets the same linked issue, or if the author now has more than two open PRs (asking them to hold off until the first two are reviewed). Members, collaborators, and bots are exempt.

How did you test it?

• GraphQL queries (closingIssuesReferences, closedByPullRequestsReferences, assignees) verified live against fix: populate split_idx_start metadata in EmbeddingBasedDocumentSplitter #11987/EmbeddingBasedDocumentSplitter does not populate split_idx_start metadata for output chunks #11986.
• end-to-end testing requires merging the PR

Notes for the reviewer

• First sweep gates the backlog: all existing open first-timer PRs with unsigned CLA get drafted at once on the first run.
• cla-pending label is auto-created; skip-cla-reminder must be created manually if wanted.
• We can bring this to haystack-core-integrations in a separate PR later on if it works well in the haystack repo

Checklist

• I have read the contributors guidelines and the code of conduct.
• I have updated the related issue with new insights and changes.
• I have added unit tests and updated the docstrings.
• I've used one of the conventional commit types for my PR title: fix:, feat:, build:, chore:, ci:, docs:, style:, refactor:, perf:, test: and added ! in case the PR includes breaking changes.
• I have documented my code.
• I have added a release note file, following the contributors guidelines.
• I have run pre-commit hooks and fixed any issue.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
haystack-docs	Ignored	Preview	Jul 15, 2026 6:33am

[davidsbatista]

We could have a const MAX_OPEN_PRS = 2 and then authored.length > MAX_OPEN_PRS

Makes the threshold easy to tune later.

[davidsbatista]

just a small suggestion for the max pr threshold

[davidsbatista]

Just a suggestion, feel free to merge with or without it