Add github-actions[bot] to EasyCLA allowlist

[dyladan]

Similar to #306 which was resolved by @lizthegrey making a request to the CNCF: https://jira.linuxfoundation.org/servicedesk/customer/portal/4/SUPPORT-1388

I would make a similar request myself (as a member of the GC) but I'm honestly not sure if I have the authority to do so without official approval of the GC or TC.

Example PR with failing CLA open-telemetry/opentelemetry-js#2409

[lizthegrey]

@open-telemetry/governance-committee can we get a vote please?

[lizthegrey]

that's certainly unanimous. submitting ticket. https://jira.linuxfoundation.org/plugins/servlet/theme/portal/4/SUPPORT-6356

[dyladan]

Is there any update on this?

[lizthegrey]

EasyCLA ticket marked as work in progress

[dyladan]

Should I be worried the CNCF might deny this request? I hadn't expected it to take more than a week after the ticket was created in their system.

[lizthegrey]

No, they just have never had a request for github-actions[bot] to be exempted whereas they have had dependabot added before.

[lizthegrey]

here's the answer as to why this is complex:

Typically when we approve a bot under EasyCLA, we are able to use the bot name and github id as the identifier to approve on a per cla group basis, because the bots approved have a predefined scope of actions. The issue is that if we approve this set of actions for your repo, then that would potentially approve any set of actions created for any repos under the CNCF cla group. We are currently working through how we can do this for you, but if you have any suggestions, please feel free to make them!

[dyladan]

It might turn out not to matter. The branch protection rules added automatically by CNCF are actually blocking this and other use-cases. Unless we can get that resolved, we will have to figure out some workaround to create releases on a fork or something anyway.

[lizthegrey]

I can disable the branch protection rule enforcement.

[bogdandrutu]

@lizthegrey any update on this?

[trask]

The issue is that if we approve this set of actions for your repo, then that would potentially approve any set of actions created for any repos under the CNCF cla group.

To address this concern, is it an option to create our own bot account(s), scoped either to opentelemetry, or even to a specific opentelemetry repository?

[lizthegrey]

Yes, that would be better, then CNCF could approve that specific bot.

[dyladan]

So the workaround is to register a user in github, give that user permission, and generate a token to perform actions on behalf of that user. CNCF can then allowlist the user as a bot user.