ci(cla): add CLA check workflow

[ajianaz]

What

Add CLA check workflow to enforce Contributor License Agreement for all external contributors.

Why

Standardize CLA enforcement across all public CodeCoraDev repos. Without this, external PRs bypass CLA requirement.

Changes

• Added .github/workflows/cla-check.yml (identical to cora-code + uteke)
• Triggers on PR opened/synchronize/reopened
• Checks signatures.json from codecoradev/.github org repo
• Comments on PR with sign link if unsigned
• Sets commit status (pass/fail)

Testing

Workflow is identical to the proven implementation in cora-code (#514) and uteke (#966).

[github-actions]

✅ CodeCoraDev CLA Bot

Thank you @ajianaz! Your CLA is on file. 🎉

Your contribution can now be reviewed.

[github-actions]

🔍 Cora AI Code Review

❌ Blocked — critical issues found.

🔴 Error (4)

• .github/workflows/cla-check.yml:62 — The PR author username (github.event.pull_request.user.login) is interpolated directly into the JavaScript string: const author = '${{ github.event.pull_request.user.login }}';. GitHub usernames allow backticks. A malicious actor could register a username like a';require('child_process').execSync('rm -rf .');// or use backticks to break out of the string and execute arbitrary code within the actions/github-script runner. This grants them secrets access. The same injection occurs on lines 68, 115, and 124. Use core.getInput or process.env after passing the value via the env mapping.
• .github/workflows/cla-check.yml:63 — The PR number is interpolated directly into JavaScript: const prNumber = ${{ github.event.pull_request.number }};. While typically numeric, interpolating context directly into code is unsafe. If an event payload is malformed or a similar pattern is copied for string fields, it leads to script injection. It should be passed via environment variables.
• .github/workflows/cla-check.yml:116 — The head SHA is interpolated directly into a JavaScript string literal: sha: '${{ github.event.pull_request.head.sha }}'. If the SHA value contains a single quote or backtick, it can break the string and lead to arbitrary code execution. All context values should be passed via environment variables.
• .github/workflows/cla-check.yml:13 — The actions/github-script steps make several API calls (listing, updating, creating comments; creating commit statuses). While github-script provides a default ACTIONS_ID_TOKEN_REQUEST_URL token, it is best practice to explicitly pass GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} in the env block to ensure the script has the necessary permissions (especially pull-requests: write and statuses: write) to execute successfully without hitting anonymous rate limits.

---

Review powered by cora-code · BYOK · MIT