fix

Author: callicles

README.md

@@ -9,7 +9,7 @@ It gives org admins a place to manage CLA text and signing history, and gives co
 - If a contributor has signed a non-current CLA version, they must re-sign before being considered compliant.
 - Contributor compliance status is evaluated per org using the contributor's latest signed version for that org.
 - If a contributor has open pull requests and their signature becomes outdated after a CLA update, checks may need to be re-opened/re-evaluated and set to failing until re-signing is completed.
-- After a contributor signs/re-signs the latest CLA, the bot updates their open PR CLA checks back to success and removes stale CLA prompt comments.
+- After a contributor signs/re-signs the latest CLA, the app schedules an async workflow that updates their open PR CLA checks to success and removes stale CLA prompt comments.
 - GitHub is the user-management source of truth for the app.
 - The app has no local signup/password user-management system; DB user rows are GitHub-linked identity mirrors only.
 - Authentication/session management is stateless JWT-based (HTTP-only cookie + signed JWT with `jti`).
@@ -160,7 +160,7 @@ This section amends your scenario list and adds missing scenarios.
 
 - Signature is stored with org, user, full CLA hash, accepted hash, assent metadata, immutable GitHub ID at signing time, timestamp, email provenance, and session evidence fields.
 - If `repo` + `pr` is provided, the signer must match that PR author before targeted PR sync is applied.
-- After signing/re-signing, open PRs authored by that contributor in the org are auto-synced: the latest CLA check run is updated to success and stale CLA prompt comments are deleted.
+- After signing/re-signing, the app schedules an async workflow to sync open PRs authored by that contributor in the org: latest CLA check runs are updated to success and stale CLA prompt comments are deleted.
 
 ### 7) Signed CLA versions cannot be deleted
 
@@ -223,7 +223,7 @@ This section amends your scenario list and adds missing scenarios.
   - Signed current CLA: passing check, no CLA comment.
   - Unsigned/outdated signature: failing check + bot comment with signing URL.
 - When CLA text changes, contributors on older signatures are marked as requiring re-sign; open PRs may require check re-evaluation and failure until re-signing.
-- After signing/re-signing, CLA checks on signer-authored open PRs are auto-updated to success and stale CLA prompt comments are removed.
+- After signing/re-signing, an async workflow updates signer-authored open PR CLA checks to success and removes stale CLA prompt comments.
 - Repository maintainers must require `CLA Bot / Contributor License Agreement` in GitHub branch protection/rulesets for merge blocking to be enforced.
 
 ## End-to-End Test Coverage Around This Spec

app/api/sign/route.ts

@@ -1,11 +1,7 @@
 import { type NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
-import {
-  SignClaError,
-  getBaseUrlFromHeaders,
-  resolveRequestEvidenceFromHeaders,
-  signClaForUser,
-} from "@/lib/cla/signing"
+import { scheduleSignerPrSyncAfterSign } from "@/lib/cla/signer-pr-sync-scheduler"
+import { SignClaError, resolveRequestEvidenceFromHeaders, signClaForUser } from "@/lib/cla/signing"
 
 export async function POST(request: NextRequest) {
   const body = await request.json()
@@ -33,10 +29,20 @@ export async function POST(request: NextRequest) {
       assented,
       consentTextVersion,
       requestEvidence: resolveRequestEvidenceFromHeaders(request.headers),
-      appBaseUrl: getBaseUrlFromHeaders(request.headers),
+    })
+    const scheduleResult = await scheduleSignerPrSyncAfterSign({
+      signResult: result,
+      actor: {
+        userId: user.id,
+        githubId: user.githubId ?? null,
+        githubUsername: user.githubUsername ?? null,
+      },
     })
 
-    return NextResponse.json(result)
+    return NextResponse.json({
+      signature: result.signature,
+      ...scheduleResult,
+    })
   } catch (error) {
     if (error instanceof SignClaError) {
       return NextResponse.json(

app/sign/[orgSlug]/actions.ts

@@ -4,12 +4,8 @@ import { headers } from "next/headers"
 import { revalidatePath } from "next/cache"
 import { z } from "zod"
 import { getSessionUser } from "@/lib/auth"
-import {
-  SignClaError,
-  getBaseUrlFromHeaders,
-  resolveRequestEvidenceFromHeaders,
-  signClaForUser,
-} from "@/lib/cla/signing"
+import { scheduleSignerPrSyncAfterSign } from "@/lib/cla/signer-pr-sync-scheduler"
+import { SignClaError, resolveRequestEvidenceFromHeaders, signClaForUser } from "@/lib/cla/signing"
 
 const signSchema = z.object({
   orgSlug: z.string().min(1),
@@ -22,6 +18,10 @@ type SignActionResult = {
   ok: boolean
   error?: string
   currentSha256?: string
+  prSyncScheduled?: boolean
+  prSyncRunId?: string | null
+  prSyncScheduleError?: string | null
+  prSyncSkippedReason?: string | null
 }
 
 export async function signClaAction(input: unknown): Promise<SignActionResult> {
@@ -41,19 +41,26 @@ export async function signClaAction(input: unknown): Promise<SignActionResult> {
   const headerStore = await headers()
 
   try {
-    await signClaForUser({
+    const result = await signClaForUser({
       ...parsed.data,
       user,
       assented: true,
       consentTextVersion: "v1",
       requestEvidence: resolveRequestEvidenceFromHeaders(headerStore),
-      appBaseUrl: getBaseUrlFromHeaders(headerStore),
+    })
+    const scheduleResult = await scheduleSignerPrSyncAfterSign({
+      signResult: result,
+      actor: {
+        userId: user.id,
+        githubId: user.githubId ?? null,
+        githubUsername: user.githubUsername ?? null,
+      },
     })
 
     revalidatePath(`/sign/${parsed.data.orgSlug}`)
     revalidatePath("/contributor")
 
-    return { ok: true }
+    return { ok: true, ...scheduleResult }
   } catch (error) {
     if (error instanceof SignClaError) {
       return {

components/sign/sign-cla-client.tsx

@@ -65,6 +65,10 @@ export function SignClaClient({
   const [justSigned, setJustSigned] = useState(false)
   const [scrolledToBottom, setScrolledToBottom] = useState(false)
   const [actionError, setActionError] = useState<string | null>(null)
+  const [postSignNotice, setPostSignNotice] = useState<{
+    tone: "info" | "warning"
+    message: string
+  } | null>(null)
   const [isPending, startTransition] = useTransition()
 
   const hasConfiguredCla = Boolean(currentSha256 && org.claMarkdown.trim().length > 0)
@@ -95,6 +99,7 @@ export function SignClaClient({
 
     startTransition(async () => {
       setActionError(null)
+      setPostSignNotice(null)
       const result = await signClaAction({
         orgSlug,
         repoName,
@@ -107,6 +112,25 @@ export function SignClaClient({
         return
       }
 
+      if (result.prSyncScheduled) {
+        setPostSignNotice({
+          tone: "info",
+          message: "Signed. Open PR checks will update automatically in the background.",
+        })
+      } else if (result.prSyncScheduleError) {
+        setPostSignNotice({
+          tone: "warning",
+          message:
+            "Signed, but background PR sync could not be scheduled. Use /recheck on open PRs if needed.",
+        })
+      } else if (result.prSyncSkippedReason === "missing_installation_id") {
+        setPostSignNotice({
+          tone: "warning",
+          message:
+            "Signed. PR sync was skipped because this org has no active GitHub installation.",
+        })
+      }
+
       setJustSigned(true)
       router.refresh()
     })
@@ -275,6 +299,18 @@ export function SignClaClient({
                 </p>
               )}
 
+              {postSignNotice && (
+                <p
+                  className={
+                    postSignNotice.tone === "warning"
+                      ? "rounded-md border border-amber-500/40 bg-amber-500/10 px-3 py-2 text-xs text-amber-300"
+                      : "rounded-md border border-primary/30 bg-primary/10 px-3 py-2 text-xs text-primary"
+                  }
+                >
+                  {postSignNotice.message}
+                </p>
+              )}
+
               <Button
                 size="lg"
                 className="gap-2"

lib/cla/signer-pr-sync-scheduler.ts

@@ -0,0 +1,84 @@
+import { start } from "workflow/api"
+import { createAuditEvent } from "@/lib/db/queries"
+import { type SignClaResult } from "@/lib/cla/signing"
+import { runSignerPrSyncWorkflow } from "@/workflows/signer-pr-sync"
+
+export type SignerPrSyncScheduleResult = {
+  prSyncScheduled: boolean
+  prSyncRunId: string | null
+  prSyncScheduleError: string | null
+  prSyncSkippedReason: string | null
+}
+
+export async function scheduleSignerPrSyncAfterSign(params: {
+  signResult: SignClaResult
+  actor: {
+    userId: string
+    githubId: string | null
+    githubUsername: string | null
+  }
+}): Promise<SignerPrSyncScheduleResult> {
+  const { signResult, actor } = params
+
+  if (!signResult.org.installationId) {
+    return {
+      prSyncScheduled: false,
+      prSyncRunId: null,
+      prSyncScheduleError: null,
+      prSyncSkippedReason: "missing_installation_id",
+    }
+  }
+
+  try {
+    const run = await start(runSignerPrSyncWorkflow, [
+      {
+        orgSlug: signResult.org.orgSlug,
+        orgId: signResult.org.id,
+        signedClaSha256: signResult.org.claSha256,
+        signer: {
+          userId: actor.userId,
+          githubId: actor.githubId,
+          githubUsername: signResult.signature.githubUsername,
+        },
+        repoName: signResult.prSyncContext.repoName,
+        prNumber: signResult.prSyncContext.prNumber,
+      },
+    ])
+
+    return {
+      prSyncScheduled: true,
+      prSyncRunId: run.runId,
+      prSyncScheduleError: null,
+      prSyncSkippedReason: null,
+    }
+  } catch (error) {
+    const scheduleError =
+      error instanceof Error ? error.message : "Unknown signer PR sync scheduling failure"
+    console.error("Failed to schedule signer PR sync workflow:", error)
+
+    try {
+      await createAuditEvent({
+        eventType: "signature.pr_sync_schedule_failed",
+        orgId: signResult.org.id,
+        userId: actor.userId,
+        actorGithubId: actor.githubId,
+        actorGithubUsername: actor.githubUsername,
+        payload: {
+          signedClaSha256: signResult.org.claSha256,
+          repoName: signResult.prSyncContext.repoName,
+          prNumber: signResult.prSyncContext.prNumber,
+          error: scheduleError,
+        },
+      })
+    } catch (auditError) {
+      console.error("Failed to write schedule failure audit event:", auditError)
+    }
+
+    return {
+      prSyncScheduled: false,
+      prSyncRunId: null,
+      prSyncScheduleError: scheduleError,
+      prSyncSkippedReason: null,
+    }
+  }
+}