foces

Author: callicles

README.md

@@ -11,6 +11,7 @@ It gives org admins a place to manage CLA text and signing history, and gives co
 - Admins can define an org-scoped bypass list of GitHub accounts that should always receive a passing CLA check.
 - If a contributor has open pull requests and their signature becomes outdated after a CLA update, checks may need to be re-opened/re-evaluated and set to failing until re-signing is completed.
 - After a contributor signs/re-signs the latest CLA, the app schedules an async workflow that updates their open PR CLA checks to success and removes stale CLA prompt comments.
+- When an org is activated/deactivated, the app schedules an async workflow to re-check open PRs for that org so checks converge to the new enforcement mode.
 - GitHub is the user-management source of truth for the app.
 - The app has no local signup/password user-management system; DB user rows are GitHub-linked identity mirrors only.
 - Authentication/session management is stateless JWT-based (HTTP-only cookie + signed JWT with `jti`).
@@ -179,7 +180,8 @@ This section amends your scenario list and adds missing scenarios.
 
 ### 9) Additional scenarios commonly missed
 
-- Org deactivated/uninstalled: signing blocked, webhook checks/comments skipped.
+- Org deactivated/uninstalled: signing blocked; webhook events set passing CLA checks and remove managed CLA prompts so PRs are not blocked by CLA while inactive.
+- Activating or deactivating an org schedules an async open-PR recheck workflow so existing PR checks/comments converge automatically.
 - Updating bypass list schedules async open-PR recheck so existing PRs converge to the latest policy.
 - `/recheck` authorization: allowed for PR author, org member, or maintainer; unauthorized users are blocked.
 - OAuth and install redirects sanitize `returnTo` to prevent open redirects.
@@ -230,6 +232,7 @@ This section amends your scenario list and adds missing scenarios.
   - Unsigned/outdated signature: failing check + bot comment with signing URL.
 - When CLA text changes, contributors on older signatures are marked as requiring re-sign; open PRs may require check re-evaluation and failure until re-signing.
 - After signing/re-signing, an async workflow updates signer-authored open PR CLA checks to success and removes stale CLA prompt comments.
+- Activating/deactivating CLA enforcement schedules async open-PR rechecks; inactive mode converges CLA checks to success and clears managed CLA prompt comments.
 - CLA bot comment updates/deletions are restricted to CLA-managed comments tagged with an internal signature marker, preventing edits to third-party bot comments.
 - Repository maintainers must require `CLA Bot / Contributor License Agreement` in GitHub branch protection/rulesets for merge blocking to be enforced.
 - Markdown ordered lists preserve explicit authored numbering (for example `1.`, `2.`, `7.` stays `1, 2, 7`), and legal alpha markers (`a.` / `a)`) render as ordered sub-clauses with indentation.

app/admin/[orgSlug]/actions.ts

@@ -117,19 +117,38 @@ export async function toggleOrganizationActiveAction(input: unknown): Promise<Ac
     return { ok: false, error: "Organization not found" }
   }
 
+  const headerStore = await headers()
+  const appBaseUrl = getBaseUrlFromHeaders(headerStore)
+  const recheck = await scheduleClaRecheckForOrg({
+    orgSlug,
+    orgId: org.id,
+    claSha256: org.claTextSha256,
+    appBaseUrl,
+    actor: {
+      userId: access.user.id,
+      githubId: access.user.githubId ?? null,
+      githubUsername: access.user.githubUsername ?? null,
+    },
+  })
+
   await createAuditEvent({
     eventType: "organization.activation_changed",
     orgId: org.id,
     userId: access.user.id,
     actorGithubId: access.user.githubId ?? null,
     actorGithubUsername: access.user.githubUsername,
-    payload: { isActive },
+    payload: {
+      isActive,
+      recheckScheduled: recheck.recheckScheduled,
+      recheckRunId: recheck.recheckRunId,
+      recheckScheduleError: recheck.recheckScheduleError,
+    },
   })
 
   revalidatePath(`/admin/${orgSlug}`)
   revalidatePath("/admin")
 
-  return { ok: true }
+  return { ok: true, ...recheck }
 }
 
 export async function addBypassAccountAction(input: unknown): Promise<ActionResult> {

app/api/webhook/github/route.ts

@@ -312,13 +312,6 @@ async function handlePrCheck(params: {
     return NextResponse.json({ error: `Organization "${orgSlug}" not found` }, { status: 404 })
   }
 
-  if (!org.isActive) {
-    return NextResponse.json({
-      message: `CLA bot is deactivated for ${orgSlug}. No check or comment.`,
-      skipped: true,
-    })
-  }
-
   const resolvedInstallationId = installationId ?? org.installationId ?? undefined
   if (installationId && org.installationId !== installationId) {
     await updateOrganizationInstallationId(orgSlug, installationId)
@@ -339,6 +332,59 @@ async function handlePrCheck(params: {
     return NextResponse.json({ error: "GitHub client is not configured" }, { status: 500 })
   }
 
+  if (!org.isActive) {
+    const check = await github.createCheckRun({
+      owner: orgSlug,
+      repo: repoName,
+      name: CHECK_NAME,
+      head_sha: headSha,
+      status: "completed",
+      conclusion: "success",
+      output: {
+        title: "CLA: Bot deactivated",
+        summary: `CLA enforcement is currently deactivated for @${orgSlug}. This pull request is not blocked by CLA requirements.`,
+      },
+    })
+
+    const existingComment = await github.findBotComment(orgSlug, repoName, prNumber)
+    let deletedCommentId: number | null = null
+    if (existingComment && isRemovableClaPromptComment(existingComment.body)) {
+      await github.deleteComment({
+        owner: orgSlug,
+        repo: repoName,
+        comment_id: existingComment.id,
+      })
+      deletedCommentId = existingComment.id
+    }
+
+    await createAuditEvent({
+      eventType: "webhook.pr_check",
+      orgId: org.id,
+      actorGithubId: prAuthorId ? String(prAuthorId) : null,
+      actorGithubUsername: prAuthor,
+      payload: {
+        owner: orgSlug,
+        repo: repoName,
+        prNumber,
+        decision: "inactive",
+        checkConclusion: check.conclusion,
+        deletedCommentId,
+      },
+    })
+
+    return NextResponse.json({
+      message: `CLA bot is deactivated for ${orgSlug}. Check set to success and CLA prompts removed.`,
+      skipped: true,
+      check: { id: check.id, status: "success", conclusion: check.conclusion },
+      comment: null,
+      orgMember: false,
+      accountOwner: false,
+      signed: true,
+      needsResign: false,
+      inactive: true,
+    })
+  }
+
   const bypassAccount = await isBypassAccountForOrg({
     orgId: org.id,
     githubUserId: prAuthorId,

components/admin/org-manage-client.tsx

@@ -227,16 +227,25 @@ export function OrgManageClient({
   function handleToggleActive() {
     startToggleActiveTransition(async () => {
       setError(null)
+      const nextIsActive = !org.isActive
       const result = await toggleOrganizationActiveAction({
         orgSlug: org.githubOrgSlug,
-        isActive: !org.isActive,
+        isActive: nextIsActive,
       })
 
       if (!result.ok) {
         setError(result.error ?? "Failed to update activation status")
         return
       }
 
+      if (result.recheckScheduleError) {
+        setError(
+          nextIsActive
+            ? "Organization activated, but async PR recheck scheduling failed."
+            : "Organization deactivated, but async PR recheck scheduling failed."
+        )
+      }
+
       router.refresh()
     })
   }

components/markdown-renderer.tsx

@@ -45,29 +45,27 @@ export function simpleMarkdownToHtml(md: string): string {
   // Process lists and blockquotes
   const lines = html.split("\n")
   const result: string[] = []
-  let listState: {
-    kind: "ol" | "ul" | "ol-alpha-lower" | "ol-alpha-upper"
-    indent: number
-  } | null = null
+  type ListKind = "ol" | "ul" | "ol-alpha-lower" | "ol-alpha-upper"
+  type ListState = { kind: ListKind; indent: number }
+  let listState: ListState | null = null
   let inBlockquote = false
 
-  const closeList = () => {
-    if (!listState) return
-    result.push(listState.kind === "ul" ? "</ul>" : "</ol>")
-    listState = null
+  const closeList = (state: ListState | null) => {
+    if (!state) return null
+    result.push(state.kind === "ul" ? "</ul>" : "</ol>")
+    return null
   }
 
-  const openList = (kind: "ol" | "ul" | "ol-alpha-lower" | "ol-alpha-upper", indent: number) => {
+  const openList = (kind: ListKind, indent: number): ListState => {
     if (kind === "ul") {
       result.push(`<ul${listIndentStyle(indent)}>`)
-      listState = { kind, indent }
-      return
+      return { kind, indent }
     }
 
     const typeAttr =
       kind === "ol-alpha-lower" ? ' type="a"' : kind === "ol-alpha-upper" ? ' type="A"' : ""
     result.push(`<ol${typeAttr}${listIndentStyle(indent)}>`)
-    listState = { kind, indent }
+    return { kind, indent }
   }
 
   for (let i = 0; i < lines.length; i++) {
@@ -84,8 +82,8 @@ export function simpleMarkdownToHtml(md: string): string {
         inBlockquote = false
       }
       if (!listState || listState.kind !== "ol" || listState.indent !== indent) {
-        closeList()
-        openList("ol", indent)
+        listState = closeList(listState)
+        listState = openList("ol", indent)
       }
       result.push(`<li value="${olMatch[2]}">${olMatch[3]}</li>`)
     } else if (alphaMatch) {
@@ -99,8 +97,8 @@ export function simpleMarkdownToHtml(md: string): string {
         inBlockquote = false
       }
       if (!listState || listState.kind !== listKind || listState.indent !== indent) {
-        closeList()
-        openList(listKind, indent)
+        listState = closeList(listState)
+        listState = openList(listKind, indent)
       }
       result.push(`<li value="${markerValue}">${alphaMatch[3]}</li>`)
     } else if (ulMatch) {
@@ -110,12 +108,12 @@ export function simpleMarkdownToHtml(md: string): string {
         inBlockquote = false
       }
       if (!listState || listState.kind !== "ul" || listState.indent !== indent) {
-        closeList()
-        openList("ul", indent)
+        listState = closeList(listState)
+        listState = openList("ul", indent)
       }
       result.push(`<li>${ulMatch[2]}</li>`)
     } else if (bqMatch) {
-      closeList()
+      listState = closeList(listState)
       if (!inBlockquote) {
         result.push("<blockquote>")
         inBlockquote = true
@@ -124,7 +122,7 @@ export function simpleMarkdownToHtml(md: string): string {
         result.push(`<p>${bqMatch[1]}</p>`)
       }
     } else {
-      closeList()
+      listState = closeList(listState)
       if (inBlockquote) {
         result.push("</blockquote>")
         inBlockquote = false
@@ -145,7 +143,7 @@ export function simpleMarkdownToHtml(md: string): string {
     }
   }
 
-  closeList()
+  listState = closeList(listState)
   if (inBlockquote) result.push("</blockquote>")
 
   return result.join("\n")

lib/cla/recheck-open-prs.ts

@@ -14,6 +14,7 @@ export type ClaOpenPrRecheckSummary = {
   rechecked: number
   failedChecks: number
   passedBypassChecks: number
+  passedInactiveChecks: number
   commentsCreated: number
   commentsUpdated: number
   commentsDeleted: number
@@ -35,6 +36,7 @@ export async function recheckOpenPullRequestsAfterClaUpdate(params: {
     rechecked: 0,
     failedChecks: 0,
     passedBypassChecks: 0,
+    passedInactiveChecks: 0,
     commentsCreated: 0,
     commentsUpdated: 0,
     commentsDeleted: 0,
@@ -51,11 +53,7 @@ export async function recheckOpenPullRequestsAfterClaUpdate(params: {
     summary.error = `Organization "${params.orgSlug}" not found`
     return summary
   }
-
-  if (!org.isActive) {
-    summary.skippedInactive = true
-    return summary
-  }
+  summary.skippedInactive = !org.isActive
 
   const resolvedInstallationId = params.installationId ?? org.installationId ?? undefined
   let github: ReturnType<typeof getGitHubClient>
@@ -81,6 +79,35 @@ export async function recheckOpenPullRequestsAfterClaUpdate(params: {
 
   for (const pr of openPrs) {
     try {
+      if (!org.isActive) {
+        await github.createCheckRun({
+          owner: params.orgSlug,
+          repo: pr.repoName,
+          name: CHECK_NAME,
+          head_sha: pr.headSha,
+          status: "completed",
+          conclusion: "success",
+          output: {
+            title: "CLA: Bot deactivated",
+            summary: `CLA enforcement is currently deactivated for @${params.orgSlug}. This pull request is not blocked by CLA requirements.`,
+          },
+        })
+
+        const existingComment = await github.findBotComment(params.orgSlug, pr.repoName, pr.number)
+        if (existingComment && isRemovableClaPromptComment(existingComment.body)) {
+          await github.deleteComment({
+            owner: params.orgSlug,
+            repo: pr.repoName,
+            comment_id: existingComment.id,
+          })
+          summary.commentsDeleted += 1
+        }
+
+        summary.passedInactiveChecks += 1
+        summary.rechecked += 1
+        continue
+      }
+
       const bypassAccount = await isBypassAccountForOrg({
         orgId: org.id,
         githubUserId: pr.authorId,