Contribution governance: DCO + CLA two-tier model, materiality triage, public API tracking#47
Merged
Merged
Conversation
cosmin-staicu
requested review from
alinahornet,
cosminvlad,
litheon,
lucianaparaschivei and
razvalex
as code owners
June 29, 2026 22:09
… triage, public API tracking Sets up the contribution model ahead of making the repo public: DCO + MIT for ordinary contributions, plus a signed CLA for material/strategic ones, with tooling that flags material contributions for a maintainer while leaving the legal decision to a human. CLA + two-tier model: - CLA.md: agreement transcribed verbatim from legal's template - CONTRIBUTING.md: when a CLA applies + the label-driven process - .github/workflows/cla.yml: legal/cla status check (green by default, red only when cla-required is set without cla-signed) + one-time signing comment Advisory materiality triage (bot proposes, human disposes): - .github/workflows/cla-triage.yml: scans each PR for objective signals (new dependency, new src/ project, public API change, large src diff, licensing files, external contributor) and applies needs-cla-review + a maintainer checklist. Never sets cla-required; only raises scrutiny, never waives it. - PR template: contributor self-declaration checkbox for employer contributions Public API surface tracking (exact, build-enforced signal): - Microsoft.CodeAnalysis.PublicApiAnalyzers 4.14.0 wired into the 7 src/ libraries only (src/Directory.Build.props); RS0016/RS0017 = error - PublicAPI.Shipped.txt baselined for all libraries; surface verified identical across net8.0 and net10.0 - triage keys off PublicAPI.Unshipped.txt instead of a public-line heuristic Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
cosmin-staicu
force-pushed
the
docs/cla-framework
branch
from
June 29, 2026 22:26
2b98036 to
3b75247
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Ahead of making this repo public, this sets up the contribution-governance model legal asked for: DCO + MIT for ordinary contributions, plus a CLA for material/strategic ones — with tooling to flag the material ones without a bot ever making the legal call.
What's in here
1. CLA + two-tier model (
03f3fe7)CLA.md— the Contributor License Agreement, transcribed verbatim from legal's template (verified by word-level diff).CONTRIBUTING.md— when a CLA applies (material, product-critical, patent-sensitive, corporate contributor, broad commercial use) and the label-driven process..github/workflows/cla.yml— alegal/clastatus check that is green by default and turns red only when a maintainer appliescla-requiredwithoutcla-signed. Posts signing instructions automatically.2. Advisory materiality triage (
f52e289).github/workflows/cla-triage.yml— scans each PR for objective signals (new dependency, newsrc/project, public-API change, largesrc/diff, licensing-file changes, external contributor) and appliesneeds-cla-review+ a maintainer checklist. Advisory only — it raises scrutiny, never waives it, and never setscla-required.3. Public API surface tracking (
2b98036)Microsoft.CodeAnalysis.PublicApiAnalyzers(4.14.0) wired into the 7src/libraries only (viasrc/Directory.Build.props).PublicAPI.Shipped.txtbaselined for all libraries;RS0016/RS0017are build errors, so any public-API change must updatePublicAPI.Unshipped.txtin the same PR. This makes "material = touches public API" an exact, build-enforced signal that the triage workflow keys off (replacing the earlier line-count heuristic).publictype fails the build withRS0016).How decisions stay human
needs-cla-review(bot) → a maintainer judges →cla-required/cla-signed(maintainer). The bot only flags candidates; the legal determination is always a person's.Repo settings (configured outside this PR)
cla-required,cla-signed,needs-cla-review.dco-signatures(the DCO audit branch): blocks force-push + deletion, no PR/check requirement so the DCO bot keeps appending.legal/claas a required status check onmain(safe — green by default).Reviewer notes
env:at the top ofcla-triage.ymland are easy to tune.PublicAPI.Unshipped.txtentries intoPublicAPI.Shipped.txt.🤖 Generated with Claude Code