name: CLA Assistant

on:
  issue_comment:
    types: [created]
  pull_request_target:
    types: [opened, closed, synchronize]

permissions:
  actions: write
  contents: write
  pull-requests: write
  statuses: write

jobs:
  cla:
    runs-on: ubuntu-latest
    steps:
      - name: CLA Assistant
        # Only act on the sign/recreate comment phrases or on PR lifecycle events.
        if: >-
          (github.event.comment.body == 'recreate-cla' ||
           github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') ||
          github.event_name == 'pull_request_target'
        # Pinned to the v2.6.1 commit SHA (supply-chain hardening; a moving tag
        # could be repointed to malicious code). Bump deliberately when upgrading.
        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Required: a PAT (classic "repo" scope, or fine-grained with Contents +
          # Pull requests write on this repo) stored as the CLA_SIGNATURES_TOKEN
          # secret. It lets the action commit signatures across forked PRs.
          PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_SIGNATURES_TOKEN }}
        with:
          path-to-document: 'https://github.com/yvgude/lean-ctx/blob/main/CLA.md'
          # Signatures are stored on a dedicated branch to keep main history clean.
          path-to-signatures: 'signatures/v1/cla.json'
          branch: 'cla-signatures'
          # Maintainer + bots never need to sign.
          allowlist: 'yvgude,dependabot[bot],*[bot]'
          custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA'
          # Friendlier, self-contained first message: explains the one-time nature,
          # the §8 Local-Free guarantee, and the exact phrase — so contributors are
          # not surprised by a bare red check and can sign in one reply.
          custom-notsigned-prcomment: |
            👋 Thanks for the contribution — we would love to merge it!

            One **one-time** step remains: please sign our [CLA](https://github.com/yvgude/lean-ctx/blob/main/CLA.md). It takes ~5 seconds, you sign **once**, and every future PR is then accepted automatically. The CLA keeps lean-ctx **Apache-2.0 and free for individual developers** (guaranteed in §8) while still allowing a hosted/commercial plane.

            **To sign:** reply to this PR with a comment containing exactly:

            > I have read the CLA Document and I hereby sign the CLA
          custom-allsigned-prcomment: 'All contributors have signed the CLA. ✅'