Enabling a new CLA for ESLint

[brianwarner]

Hi, I've been talking with @nzakas about changing from the old JSF CLA bot to the new OpenJS Foundation EasyCLA bot. If you're a regular contributor to ESLint, you'll want to keep reading for some tips on handling the transition.

First, some brief background. A few years ago the JS Foundation merged with Node.js Foundation to form the OpenJS Foundation. The JS Foundation required a CLA, and operated a bot to enforce signatures. The OpenJS Foundation no longer requires projects to use a CLA; it is left to each project's maintainers to decide whether to use the DCO (at minimum) or the OpenJS Foundation CLA.

For projects that continue using a CLA, two big things changed. First, we're using a different tool called EasyCLA. It is developed and managed by the Linux Foundation (including the underlying infrastructure). CLAs can be signed either by individuals acting on their own behalf, or signed by companies on behalf of their employees. Also, because we're working from a centralized CLA infrastructure, contributors who sign the OpenJS Foundation CLA once are covered for any other OpenJS Foundation projects.

Second, we've changed the text of the CLA. The JSF CLA was essentially a bespoke wrapper around the text of the DCO, which meant contributors (and their legal counsel) would have to evaluate something completely new. In keeping with the Principle of Least Astonishment, we've changed to the much more common Apache-style CLA templates. If you need your company to sign your CLA, there's now a much better chance your counsel will recognize what they're seeing.

Because the organization and the CLA text have both changed, we can't continue to use the old signatures. Subsequent contributions will require you to sign the new document. To be clear, this only applies to new contributions; prior contributors do not need to go back and re-sign the document unless they make a new contribution.

So what do you need to do? You can always just wait until the bot is enabled and sign the doc when you open your first PR. If you aren't already in the system, it'll leave a comment on your PR with a link to follow. If you want to make things easier, or if you're a high-volume contributor and want to get it out of the way early, you can pre-sign the OpenJS Foundation CLA by opening a trivial PR against this repo (we periodically close open PRs).

If you have any questions, please ask!

[nzakas]

@btmills @mdjermanovic just want to check that you are on board with this? Any questions?

[btmills]

No objections from me.

[mdjermanovic]

No objections from me, too.

[nzakas]

@brianwarner looks like we are set to move forward. Can you also remove the old CLA check in the process?

[brianwarner]

Sounds good, thank you! I'm just making sure we have the bots added to the pre-approved list, and when that happens I'll decommission the webhook for the old CLA, and switch EasyCLA on.

…

On Thu, Aug 19, 2021 at 8:18 PM Nicholas C. Zakas ***@***.***> wrote: @brianwarner <https://github.com/brianwarner> looks like we are set to move forward. Can you also remove the old CLA check in the process? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#14943 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOVQJXTJ6CC3MJUXPTC6OLT5WNNTANCNFSM5CLBRGYA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email> .

-- *Brian Warner* The Linux Foundation ***@***.*** +1 724 301-6171

[nzakas]

Great, thanks!

[brianwarner]

Ok, bots are added as of earlier this week! Should be good to go, drop me a line on Slack when you're ready and I'll make the swap. If there are issues, it would be helpful if they could be reported on this thread. Thanks!

…

On Fri, Aug 20, 2021 at 8:24 PM Nicholas C. Zakas ***@***.***> wrote: Great, thanks! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#14943 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOVQJVPCUBS2VYD3YNV4HDT53W3TANCNFSM5CLBRGYA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email> .

-- *Brian Warner* The Linux Foundation ***@***.*** +1 724 301-6171

[nzakas]

Messaged you on Slack but adding here for transparency. We are ready to switch.

[brianwarner]

Hi folks, following up - the CLA has been swapped. Please let me know if there are any issues.

[snitin315]

I see the old CLA check is still there (#14985) -

[nzakas]

@brianwarner it looks like the old CLA check status is still showing up on PRs and blocking merging. See #14976 as an example.

[brianwarner]

Thanks for the heads up. I went into the repo and removed `license/cla` as a required check, and retriggered the workflows. I'll monitor it, but it looks like it is re-running without the cla check. I believe that if there are other PRs, anything that retriggers the workflows (closing/immediately re-opening a PR, pushing a new commit, etc) should remove the blocking check. I'll keep an eye on this one, but please let me know if other issues come up.

…

On Mon, Aug 30, 2021 at 8:34 PM Nicholas C. Zakas ***@***.***> wrote: @brianwarner <https://github.com/brianwarner> it looks like the old CLA check status is still showing up on PRs and blocking merging. See #14976 <#14976> as an example. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#14943 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOVQJWMJICFJU6O7JO5EYDT7QPQFANCNFSM5CLBRGYA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- *Brian Warner* The Linux Foundation ***@***.*** +1 724 301-6171

[brianwarner]

Looks like it worked and you're ready to merge. For the record, here's what I did: Settings -> Branches -> Branch Protection Rules -> Edit (for `master`) -> Under "Require status checks to pass before merging", uncheck `license/cla` -> Save On Mon, Aug 30, 2021 at 10:01 PM Brian Warner ***@***.***> wrote:

…

Thanks for the heads up. I went into the repo and removed `license/cla` as a required check, and retriggered the workflows. I'll monitor it, but it looks like it is re-running without the cla check. I believe that if there are other PRs, anything that retriggers the workflows (closing/immediately re-opening a PR, pushing a new commit, etc) should remove the blocking check. I'll keep an eye on this one, but please let me know if other issues come up. On Mon, Aug 30, 2021 at 8:34 PM Nicholas C. Zakas < ***@***.***> wrote: > @brianwarner <https://github.com/brianwarner> it looks like the old CLA > check status is still showing up on PRs and blocking merging. See #14976 > <#14976> as an example. > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > <#14943 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAOVQJWMJICFJU6O7JO5EYDT7QPQFANCNFSM5CLBRGYA> > . > Triage notifications on the go with GitHub Mobile for iOS > <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> > or Android > <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. > > -- *Brian Warner* The Linux Foundation ***@***.*** +1 724 301-6171

-- *Brian Warner* The Linux Foundation ***@***.*** +1 724 301-6171

[nzakas]

Great, thanks!

[tordans]

Hi, JFYI, when I click on "Contributor License Agreement" https://cla.js.foundation/eslint/eslint on https://github.com/eslint/eslint/blob/master/docs/developer-guide/contributing/README.md#signing-the-cla I get an Error

Error
There is no CLA to sign for eslint/eslint

({"message":"Must specify access token via Authorization header. https://developer.github.com/changes/2020-02-10-deprecating-auth-through-query-param","documentation_url":"https://docs.github.com/v3/#oauth2-token-sent-in-a-header"})

[brianwarner]

Yes, unfortunately the legacy JSF CLA infra is genuinely offline, probably permanently. We had been working on a graceful transition to the new infra as the plan has always been to decommission it, but this stepped up the timetable.

I'll open a PR against that documentation with the new info.

[nzakas]

@tordans can you open an issue for that?

[brianwarner]

Here's a PR: #15058