Enabling the OpenJS Foundation CLA bot

[brianwarner]

Hi, I've been talking with @sokra and @chenxsan about changing from the old JSF CLA bot to the new OpenJS Foundation EasyCLA bot. If you're a regular contributor to webpack, you'll want to keep reading for some tips on handling the transition.

First, some brief background. A few years ago the JS Foundation merged with Node.js Foundation to form the OpenJS Foundation. The JS Foundation required a CLA, and operated a bot to enforce signatures. The OpenJS Foundation no longer requires projects to use a CLA; it is left to each project's maintainers to decide whether to use the DCO (at minimum) or the OpenJS Foundation CLA.

For projects that continue using a CLA, two big things changed. First, we're using a different tool called EasyCLA. It is developed and managed by the Linux Foundation (including the underlying infrastructure). CLAs can be signed either by individuals acting on their own behalf, or signed by companies on behalf of their employees. Also, because we're working from a centralized CLA infrastructure, contributors who sign the OpenJS Foundation CLA once are covered for any other OpenJS Foundation projects.

Second, we've changed the text of the CLA. The JSF CLA was essentially a bespoke wrapper around the text of the DCO, which meant contributors (and their legal counsel) would have to evaluate something completely new. In keeping with the Principle of Least Astonishment, we've changed to the much more common Apache-style CLA templates. If you need your company to sign your CLA, there's now a much better chance your counsel will recognize what they're seeing.

Because the organization and the CLA text have both changed, we can't continue to use the old signatures. Subsequent contributions will require you to sign the new document. To be clear, this only applies to new contributions; prior contributors do not need to go back and re-sign the document unless they make a new contribution.

So what do you need to do? You can always just wait until the bot is enabled and sign the doc when you open your first PR. If you aren't already in the system, it'll leave a comment on your PR with a link to follow. If you want to make things easier, or if you're a high-volume contributor and want to get it out of the way early, you can pre-sign the OpenJS Foundation CLA by opening a trivial PR against this repo (we periodically close open PRs).

If you have any questions, please ask!

[snitin315]

I am 👍🏻 on this, the old bot is a bit buggy as well.

[brianwarner]

Following up on this, I've just enabled EasyCLA across both https://github.com/webpack and https://github.com/webpack-contrib and deleted the webhook for the JSF CLA.

@snitin315 I see in another commit that the old bot was hung up on a response (i.e., the license/cla check never returns). Based upon some other projects that were using the JSF CLA infra, here's one thing that seems to work:

• In the repo settings, I go into Branches and edit the branch protection rules
• I remove license/cla
• Closing and immediately reopening the PR seems to retrigger the checks, and clear out the license/cla one.

I see this one has that issue, I'm going to attempt to close/re-open and see if it fixes it.

[alexander-akait]

Thank you help, I think we can close it since we reconfigured it everywhere