cla-check.yml

name: CLA Check

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  pull-requests: write
  contents: read

jobs:
  cla-check:
    runs-on: ubuntu-latest
    if: "!contains(fromJSON('[\"app/dependabot\", \"app/renovate\", \"github-actions[bot]\"]'), github.event.pull_request.user.login)"
    steps:
      - name: Fetch & check CLA signature
        id: check
        run: |
          # Fetch signatures.json directly from raw GitHub (public repo)
          # Use wget as primary (handles 200-with-404-body better than curl)
          wget -q -O signatures.json "https://raw.githubusercontent.com/codecoradev/.github/main/.cla/signatures.json" 2>/dev/null \
            || curl -sfL "https://raw.githubusercontent.com/codecoradev/.github/main/.cla/signatures.json" -o signatures.json 2>/dev/null \
            || echo '{"signatures":[]}' > signatures.json
          # Validate JSON — if invalid, use empty
          python3 -c "import json; json.load(open('signatures.json'))" 2>/dev/null \
            || echo '{"signatures":[]}' > signatures.json
          python3 - << 'EOF'
          import json, os

          author = os.environ["PR_AUTHOR"]
          with open("signatures.json") as f:
              data = json.load(f)

          signatures = data.get("signatures", [])
          found = any(
              s.get("github_username", "").lower() == author.lower()
              for s in signatures
          )

          with open(os.environ["GITHUB_OUTPUT"], "a") as f:
              f.write(f"signed={'true' if found else 'false'}\n")

          print(f"CLA signed by @{author}: {found}")
          EOF
        env:
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}

      - name: Comment on PR (same-repo, best effort)
        if: steps.check.outputs.signed != 'true' && github.event.pull_request.head.repo.full_name == github.repository
        continue-on-error: true
        uses: actions/github-script@v9
        with:
          script: |
            const author = '${{ github.event.pull_request.user.login }}';
            const prNumber = ${{ github.event.pull_request.number }};

            const body = [
                  '## ⚠️ CodeCoraDev CLA Bot',
                  '',
                  `Hi @${author}! Thanks for your contribution.`,
                  '',
                  'Before this PR can be reviewed, please sign our Contributor License Agreement:',
                  '',
                  '- 📋 **Individual?** → [Sign CLA Individual](https://codecoradev.github.io/cla/?type=individual)',
                  '- 🏢 **Corporate?** → [Sign CLA Corporate](https://codecoradev.github.io/cla/?type=corporate)',
                  '',
                  '---',
                  '<sub>By signing, you agree to the terms in [CLA_INDIVIDUAL.md](https://github.com/codecoradev/.github/blob/main/CLA_INDIVIDUAL.md) or [CLA_CORPORATE.md](https://github.com/codecoradev/.github/blob/main/CLA_CORPORATE.md).</sub>',
                ].join('\n');

            // Find existing CLA bot comment
            const comments = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber,
            });

            const botComment = comments.data.find(c =>
              c.user.login === 'github-actions[bot]' &&
              c.body.includes('CodeCoraDev CLA Bot')
            );

            if (botComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: prNumber,
                body,
              });
            }

      - name: Fail if not signed
        if: steps.check.outputs.signed != 'true'
        run: |
          echo "::error title=CLA not signed::Sign the CodeCoraDev CLA at https://codecoradev.github.io/cla — once the signature PR is merged, this check turns green automatically (re-run it or wait ~1 hour)."
          echo "❌ CLA not signed by ${{ github.event.pull_request.user.login }}"
          exit 1