Upgrading the CLA tool

[brianwarner]

Hi, I've been talking with @marwahaha about changing from the old JSF CLA bot to the new OpenJS Foundation EasyCLA bot. If you're a regular contributor to moment, you'll want to keep reading for some tips on handling the transition. With moment being in maintenance mode, our goal is to get to a steady state before we sunset the JSF's CLA bot.

First, some brief background. A few years ago the JS Foundation merged with Node.js Foundation to form the OpenJS Foundation. The JS Foundation required a CLA, and operated a bot to enforce signatures. The OpenJS Foundation no longer requires projects to use a CLA; it is left to each project's maintainers to decide whether to use the DCO (at minimum) or the OpenJS Foundation CLA.

For projects that continue using a CLA, two big things changed. First, we're using a different tool called EasyCLA. It is developed and managed by the Linux Foundation (including the underlying infrastructure). CLAs can be signed either by individuals acting on their own behalf, or signed by companies on behalf of their employees. Also, because we're working from a centralized CLA infrastructure, contributors who sign the OpenJS Foundation CLA once are covered for any other OpenJS Foundation projects.

Second, we've changed the text of the CLA. The JSF CLA was essentially a bespoke wrapper around the text of the DCO, which meant contributors (and their legal counsel) would have to evaluate something completely new. In keeping with the Principle of Least Astonishment, we've changed to the much more common Apache-style CLA templates. If you need your company to sign your CLA, there's now a much better chance your counsel will recognize what they're seeing.

Because the organization and the CLA text have both changed, we can't continue to use the old signatures. Subsequent contributions will require you to sign the new document. To be clear, this only applies to new contributions; prior contributors do not need to go back and re-sign the document unless they make a new contribution.

So what do you need to do? You can always just wait until the bot is enabled and sign the doc when you open your first PR. If you aren't already in the system, it'll leave a comment on your PR with a link to follow. If you want to make things easier, or if you're a high-volume contributor and want to get it out of the way early, you can pre-sign the OpenJS Foundation CLA by opening a trivial PR against this repo (we periodically close open PRs).

If you have any questions, please ask!

[brianwarner]

Following up, the changeover is complete.

PRs opened prior to the change may still have the stalled license/cla check. Because the old CLA infrastructure is no longer working, these checks will never complete. In the very specific situation where all other checks are passing (including EasyCLA) and license/cla is the only outstanding check, a maintainer may override license/cla and merge the PR. This will likely only apply to PRs that were already open during the change.