Add the CAA check workflow - #1
Merged
Merged
Conversation
serialize.java had no CAA workflow. Glenn's ruling of 2026-08-30 puts the CAA on every open source repo, so this adds the emitter here. This is netcode's .github/workflows/cla.yml unchanged, the same blob b8d5d65 that netcode, reliable and yojimbo carry. The file holds no repo name, branch or path filter, so it is correct verbatim. The job id caa is what names the check run, which is the context the org ruleset "Require CAA signature" asks for when an org owner adds this repo to it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Glenn ruled on 2026-08-30 that the CAA stays on the serialize repos, and goes on every open source repo from here on. This repo had no CAA workflow at all, so this adds one.
The file is
netcode/.github/workflows/cla.ymlcopied verbatim, byte for byte: the blob hash here is the sameb8d5d657object that netcode, reliable and yojimbo already carry. It holds no repo name, no branch filter and no path filter, so nothing needed adapting. The job idcaais what names the check run, and that is the context the org ruleset "Require CAA signature" asks for: netcode PR #180 merged on 2026-08-26 with a check run named exactlycaaunder the workflow "Contributor Assignment Agreement". The org secret CLA_SIGNATURES_TOKEN is visible to this repo already.No
caacheck will appear on this pull request. The workflow triggers onpull_request_target, which reads the workflow file from the base branch, and the base branch does not have it until this merges. It starts reporting on pull requests opened after that.This repo is not yet under the org ruleset, so once the check does report it will not block anything. That ordering is deliberate: the emitter goes in first, and an org owner adds the repo to the ruleset afterwards. Doing it the other way round is what left serialize, serialize.go and serialize.rs with a required check and nothing to report it.
Nothing here touches LICENSE, licensing prose or package license metadata.