ci(cla): add CLA check workflow

[ajianaz]

What

Add CLA check workflow to enforce Contributor License Agreement for all external contributors.

Why

Standardize CLA enforcement across all public CodeCoraDev repos. Without this, external PRs bypass CLA requirement.

Changes

• Added .github/workflows/cla-check.yml (identical to cora-code + uteke)
• Triggers on PR opened/synchronize/reopened
• Checks signatures.json from codecoradev/.github org repo
• Comments on PR with sign link if unsigned
• Sets commit status (pass/fail)

Testing

Workflow is identical to the proven implementation in cora-code (#514) and uteke (#966).

[github-actions]

✅ CodeCoraDev CLA Bot

Thank you @ajianaz! Your CLA is on file. 🎉

Your contribution can now be reviewed.

[github-actions]

🔍 Cora AI Code Review

❌ Blocked — critical issues found.

🔴 Error (2)

• .github/workflows/cla-check.yml:62 — The PR author username (github.event.pull_request.user.login) is interpolated directly into the inline JavaScript via single quotes: const author = '${{ github.event.pull_request.user.login }}';. GitHub usernames can contain single quotes (or an attacker could rename themselves to include a quote), which would break out of the string and allow arbitrary JavaScript execution in the github-script action context. This grants the PR author the ability to run arbitrary code with the workflow's GITHUB_TOKEN (which has pull-requests: write and statuses: write). The same injection also affects prNumber on line 63, though number is safer as it's an integer. The head.sha on line 113 is also interpolated but SHA hashes are restricted to hex characters, making them safe.
• .github/workflows/cla-check.yml:16 — The actions/github-script@v7 steps do not explicitly pass the GITHUB_TOKEN. While actions/github-script automatically provides a default token, relying on the default token in conjunction with explicit permissions: blocks at the top of the workflow can sometimes lead to unexpected permission denials depending on repository settings. It is best practice to explicitly map the token to ensure the action uses a token with the intended scopes.

---

Review powered by cora-code · BYOK · MIT