Implement a Contributor License Agreement check to Pull requests to ensure all contributors have signed the CLA

[lewisdaly]

Goal:

As a Project Maintainer,
I want to enforce a Contributor License Agreement (CLA)
so that we can ensure the IP of mojaloop contributions are clearly defined.

Tasks:

• Find/track down an appropriate CLA for Mojaloop
• Investigate the best method for signing and ensuring that new contributors have signed the CLA
• Update the documentation for contributing to Mojaloop to include a step for signing the CLA

Acceptance Criteria:

• Documentation Style meets standards
• CLA Agreed upon and integrated
• CLA bot applied to the Mojaloop Organization

Pull Requests:

• TBD

Follow-up:

• N/A

Dependencies:

• N/A

Accountability:

• Owner: @lewisdaly
• QA/Review: @kjw000

[kjw000]

thanks for driving this one.

[lewisdaly]

@kjw000 I found a simple tool that can take care of this for us: https://github.com/cla-assistant/cla-assistant

We just need to sign in with github, put the CLA in a gist, and link the cla assistant to a given repo.

Then the process of signing the agreement from a pull request is quite straightforward. Here's some screenshots that show the process.

1. Open a pull request and see that the license/cla check is pending:

2. Click "Details", and Sign the agreement:

Do we already have an existing CLA that I can use? Or do you need me to also find a CLA that will be suitable for the project?

[kjw000]

@lewisdaly - please include Paula Hunter (not sure she is on github) but lets run this by her. We might have one from the foundation or the entity we can leverage.

[lewisdaly]

We are currently waiting for Gates Legal on this one.

[lewisdaly]

This is blocked by waiting for the Mojaloop Entity set up.

[lewisdaly]

Here's an draft set of documentation for signing and administering the CLA: https://github.com/vessels-tech/documentation/blob/feature/cla-example/contributors-guide/signing-the-cla.md

[elnyry-sam-k]

This looks good @lewisdaly; I have a minor question.. Is it required for every PR or once someone signs it for mojaloop, then they're good? Or are there other options with granularity, company, etc..

[lewisdaly]

You can either have a per-organization CLA or a per-repo CLA. I think we want it to be per-organization, and I'm pretty sure that means that once you sign it for the Mojaloop Github Org, then you are good for any pull request to any repo within the Mojaloop org.

[elnyry-sam-k]

Cool, thanks Lewis; that works.

[kjw000]

Agree - we want it for the entire organization (not per repo) thanks.

[lewisdaly]

Done!