chore(IDX): add github token to CLA check

[cgundy]

There was a permissions issue with running the CLA, so I'm trying to add the token.

[jwndlng]

A general comment: Can we please use pinned actions instead of version/branches?

[cgundy]

Can we please use pinned actions instead of version/branches?

Sure, I'll actually add that to a different PR first

[cgundy]

Can we please use pinned actions instead of version/branches?

Addressed in #160

[basvandijk]

the repo needs to check out the repo itself so that it can either close

Are you sure?

The example from superbrothers/close-pull-request doesn't mention that a checkout is needed.

or add a label.

The example from actions/github-script? also doesn't mention you need a checkout.

[jwndlng]

I think the checkout is used so that the context changes to the other repo and the GH commands will automatically target this repo. This can potentially be avoided by explicitly naming the target repo.

E.g.

      - name: Add Label
        uses: actions/github-script@v6
        if: ${{ steps.accepts_external_contrib.outputs.accepts_contrib != 'false' }}
        with:
          script: |
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: ["external-contributor"]
            })

could be

      - name: Add Label
        uses: actions/github-script@v6
        if: ${{ steps.accepts_external_contrib.outputs.accepts_contrib != 'false' }}
        with:
          script: |
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              owner: github.event.pull_request.base.repo.owner.login,
              repo: github.event.pull_request.base.repo.name,
              labels: ["external-contributor"]
            })

[cgundy]

So actually, the error we were getting was a permissions error: https://github.com/dfinity/pic-js/actions/runs/15072330334/job/42371540281?pr=134 - is it possible the issue is something else entirely? The CLA github app has write access to pull requests for all repos, so I assumed it was related to the change we made with removing the checkout step.

[cgundy]

I can try Jan's suggestion as well

[jwndlng]

LGTM