chore(cla): call the shared CLA reusable instead of a self-hosted job (ENG-2017)

[lucas-koontz]

User story

As a maintainer of this repository
I want the CLA check to run on a disposable GitHub-hosted runner
So that a stranger opening a pull request cannot start a pod inside our clusters

Why this matters

cla.yml ran on mdb-dev, which is not a GitHub VM. It is a pod inside our newdev
EKS cluster, holding a Kubernetes identity, an AWS role and a filesystem other
repositories' credentialed jobs write into.

This workflow triggers on pull_request_target and issue_comment. Both run in
base-repo context, so GitHub's fork-approval gate never applies: the run starts
when a pull request opens or a comment is posted, from any account, with nobody
clicking anything. Outside accounts have already done it here.

The job also ran contributor-assistant/github-action@v2.6.1, a mutable tag, so
whoever controls that tag upstream chose what ran on the pod.

What happens today

flowchart TD
    S["Any GitHub account"] --> E["Opens a PR, or comments on any issue"]
    E --> N["Base-repo trigger, so no approval gate applies"]
    N --> J["Job claims a pod on mdb-dev"]
    J --> P["Four write scopes on GITHUB_TOKEN"]
    J --> A["Third-party action on a mutable tag"]

Loading

What should happen

flowchart TD
    S["Any GitHub account"] --> E["Opens a PR, or comments on any issue"]
    E --> G{"Job condition: a PR event, or a CLA comment?"}
    G -->|"no, an unrelated comment"| SKIP["Job skipped, no runner claimed"]
    G -->|"yes"| J["Job runs on ubuntu-latest"]
    J --> A["Action pinned to a commit SHA"]

Loading

Acceptance criteria

• The CLA job no longer requests mdb-dev.
• An issue_comment that is not a CLA comment leaves the job skipped, with no runner claimed.
• A pull request still gets the check, so an unsigned author is asked to sign.
• Negative: the existing signature ledger is untouched and still readable.

How to test

1. Open a pull request from a fork using an account that is not in the allowlist. The CLA job runs on a GitHub-hosted runner and the bot comments asking for a signature.
2. Comment the signature phrase. The re-check passes and the signature lands on the cla branch.
3. Comment something unrelated on any open issue. The CLA workflow shows the job as skipped and claims no runner.

Notes for the reviewer

The allowlist is gone from this file, and staff now sign like everybody else. Fifteen repositories carried six different hand-maintained copies naming 25 people between them, and 11 of those 25 had already left the org while still being exempt from signing. It now defaults in the reusable and is bots only: dependabot[bot] and mindsdb-release-train[bot], the two that actually open pull requests in this org. A bot cannot post the agreement sentence, so without an exemption its pull request is red forever.

Dropping the line also drops two live defects that rode inside it. bot* compiled to an unanchored new RegExp("bot.*").test(login), so it exempted any login containing "bot", including robotnik and sabotage; anyone could opt out of the CLA by choosing a username. And Stpmax never matched the real login StpMax, because non-wildcard entries use a case-sensitive ===. Needs mindsdb/github-actions#56, which gives the input its default.

.github/ gets a code owner. This repo had no CODEOWNERS, so a change to what runs in CI, on which runner, and with which secrets in scope needed no particular reviewer, on a repo that accepts outside pull requests. Auto-request only for now: a hard gate needs require_code_owner_reviews in branch protection, which this repo does not set and which rides ENG-2013's org ruleset. Faking it here would be a file that looks like a control and is not one.

The green CLAssistant row on this pull request does not exercise this change. pull_request_target loads the workflow from the base branch, so the check that passed here is the copy this PR replaces, running on mdb-dev. The new job cannot test itself on its own pull request; it is exercised on the first pull request opened after this merges.

The on: and permissions: blocks swap places, which is why the diff looks bigger than it is. Every converted wrapper now reads name, permissions, triggers, job, in that order. No trigger and no scope changes as a result of the move itself.

This replaces a hand-rolled job with the reusable anton, cowork and cowork-server already call. Nothing new was invented. The reusable is hardened in the same change set at mindsdb/github-actions, which pins the action to a commit, moves the event filter from the step to the job, drops its runs-on input entirely, and reduces actions: write to actions: read.

The actions scope is read, not write, and that is deliberate. The upstream README asks for write. The only write it buys is pullRerunRunner.ts re-running a previously failed CLA run, and that API refuses a GITHUB_TOKEN, so the call already failed and was swallowed. Dropping the scope altogether does break the job, because the same file lists the repository's workflows first and main.ts turns any throw into a failure.

The signature ledger is untouched. path-to-signatures and branch still resolve to the same file on the same branch, so every existing signature stays where it is.

The agreement link names the canonical repository rather than a redirect. Every URL the org used for this document was a rename redirect. They all resolve to the same file and serve byte-identical content, so nothing changes for a reader today. A redirect stops being harmless the moment somebody creates a repository at the old name, and this is the page a contributor reads before agreeing to it.

Verified locally

Check	What I observed
actionlint on the changed file	Clean, v1.7.12. This repo runs no workflow linter of its own, so I ran the version the org's shared lint workflow pins.
The reusable's runner default	Read from mindsdb/github-actions@main: runs-on: ubuntu-latest, and after this change set the input does not exist at all.
Nothing else reads the removed input	gh search code over the org: anton, cowork and cowork-server call the reusable and none of them passes runs-on.
The existing ledger	Still resolves on the cla branch, 2 signers, unchanged by this PR.

Ships with

One behaviour across eleven repositories, one pull request each. The anchor is
mindsdb/github-actions, which hardens the shared reusable this file now calls.
There is no Deploys: line and no pull request environment: these are library
repositories with no deploy pipeline, so nothing here brings up an environment.

Merge order: the anchor first, and that is a requirement rather than a
preference. This wrapper grants actions: read, and until
mindsdb/github-actions#55 merges the reusable still declares actions: write.
A called workflow's permissions are enforced when its file is loaded, so a
callee naming a scope its caller has not granted rejects the whole run as a
startup_failure with zero jobs, and there is no job left to report it. The
run is red, the CLA gate is down, and nothing announces either.

Refs: ENG-2017

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
mindsdb_sdk
agents.py	179	47	74%	29, 101, 104, 107, 110, 118, 126, 146, 167, 178, 181, 185, 187, 189, 191, 193, 195, 197, 261, 274, 285, 296, 299–303, 318, 327–331, 375, 383–384, 442, 450–451, 455, 486–488, 490–491, 518–519, 521
databases.py	58	7	88%	85–86, 149, 177, 188–194
handlers.py	37	1	97%	77
jobs.py	97	7	93%	40, 52, 80, 84, 146–149
knowledge_bases.py	130	18	86%	70–73, 132–136, 160, 189, 196, 200–202, 206, 228–232, 242
ml_engines.py	42	3	93%	94, 126, 128
models.py	211	19	91%	109, 140–141, 222, 231, 233, 303, 339, 349, 373, 398, 492, 500, 519, 535, 543, 568, 572, 585
projects.py	61	1	98%	158
query.py	13	1	92%	14
server.py	31	2	94%	86–87
tables.py	130	15	88%	140–142, 145, 165, 192, 203–204, 209, 224, 227, 321, 342–347, 356, 376
tree.py	32	16	50%	18–19, 24–28, 41–57
views.py	37	2	95%	105, 138
mindsdb_sdk/connectors
rest_api.py	240	56	77%	19–29, 35–36, 51, 55, 58–59, 79–81, 87–89, 108, 111, 118–121, 144, 158–166, 187–188, 223–226, 240–241, 295–300, 304–316
mindsdb_sdk/utils
agents.py	50	4	92%	72, 79–81
mind.py	47	47	0%	1–128
openai.py	85	30	65%	37–40, 83–85, 107, 148–158, 215–216, 234–240, 258–276
table_schema.py	21	21	0%	1–54
TOTAL	1582	297	81%

Tests	Skipped	Failures	Errors	Time
26	0 💤	0 ❌	0 🔥	6.784s ⏱️