fixes

Author: callicles

README.md

@@ -9,6 +9,7 @@ It gives org admins a place to manage CLA text and signing history, and gives co
 - If a contributor has signed a non-current CLA version, they must re-sign before being considered compliant.
 - Contributor compliance status is evaluated per org using the contributor's latest signed version for that org.
 - If a contributor has open pull requests and their signature becomes outdated after a CLA update, checks may need to be re-opened/re-evaluated and set to failing until re-signing is completed.
+- After a contributor signs/re-signs the latest CLA, the bot updates their open PR CLA checks back to success and removes stale CLA prompt comments.
 - GitHub is the user-management source of truth for the app.
 - The app has no local signup/password user-management system; DB user rows are GitHub-linked identity mirrors only.
 - Authentication/session management is stateless JWT-based (HTTP-only cookie + signed JWT with `jti`).
@@ -158,8 +159,8 @@ This section amends your scenario list and adds missing scenarios.
 ### 6) Contributor signs/re-signs CLA
 
 - Signature is stored with org, user, full CLA hash, accepted hash, assent metadata, immutable GitHub ID at signing time, timestamp, email provenance, and session evidence fields.
-- For linked PR context (`repo` + `pr`), failing CLA check/comment can be updated to success/signed status.
-- Current behavior note: updates are scoped to known PR context, not guaranteed bulk update of all open PRs for that contributor.
+- If `repo` + `pr` is provided, the signer must match that PR author before targeted PR sync is applied.
+- After signing/re-signing, open PRs authored by that contributor in the org are auto-synced: the latest CLA check run is updated to success and stale CLA prompt comments are deleted.
 
 ### 7) Signed CLA versions cannot be deleted
 
@@ -222,7 +223,7 @@ This section amends your scenario list and adds missing scenarios.
   - Signed current CLA: passing check, no CLA comment.
   - Unsigned/outdated signature: failing check + bot comment with signing URL.
 - When CLA text changes, contributors on older signatures are marked as requiring re-sign; open PRs may require check re-evaluation and failure until re-signing.
-- After signing/re-signing, check/comment can auto-update for the target PR context.
+- After signing/re-signing, CLA checks on signer-authored open PRs are auto-updated to success and stale CLA prompt comments are removed.
 - Repository maintainers must require `CLA Bot / Contributor License Agreement` in GitHub branch protection/rulesets for merge blocking to be enforced.
 
 ## End-to-End Test Coverage Around This Spec

lib/cla/signing.ts

@@ -6,7 +6,6 @@ import {
   getSignatureStatus,
 } from "@/lib/db/queries"
 import { getGitHubClient, type CheckRun } from "@/lib/github"
-import { generateSignedComment } from "@/lib/pr-comment-template"
 
 const CHECK_NAME = "CLA Bot / Contributor License Agreement"
 const DEFAULT_CONSENT_TEXT_VERSION = "v1"
@@ -43,7 +42,7 @@ type SignClaInput = {
 type SignClaResult = {
   signature: Awaited<ReturnType<typeof createSignature>>
   updatedChecks: CheckRun[]
-  updatedCommentId: number | null
+  deletedCommentIds: number[]
   autoUpdateSkippedReason: string | null
 }
 
@@ -57,7 +56,6 @@ export async function signClaForUser(input: SignClaInput): Promise<SignClaResult
     assented,
     consentTextVersion,
     requestEvidence,
-    appBaseUrl,
   } = input
 
   if (!orgSlug) {
@@ -162,79 +160,97 @@ export async function signClaForUser(input: SignClaInput): Promise<SignClaResult
 
   const versionLabel = org.claTextSha256.slice(0, 7)
   const updatedChecks: CheckRun[] = []
-  let updatedCommentId: number | null = null
+  const deletedCommentIds: number[] = []
   let autoUpdateSkippedReason: string | null = null
 
-  if (normalizedRepoName && parsedPrNumber && org.installationId) {
+  if (!org.installationId) {
+    autoUpdateSkippedReason = "missing_installation_id"
+  } else {
     try {
       const github = getGitHubClient(org.installationId)
-      const pullRequest = await github.getPullRequest(orgSlug, normalizedRepoName, parsedPrNumber)
-
-      if (!pullRequest) {
-        autoUpdateSkippedReason = "pull_request_not_found"
-      } else if (
-        (typeof pullRequest.authorId === "number" &&
-          String(pullRequest.authorId) !== user.githubId) ||
-        (typeof pullRequest.authorId !== "number" &&
-          pullRequest.authorLogin !== user.githubUsername)
-      ) {
-        autoUpdateSkippedReason = "signer_not_pr_author"
-      } else {
-        const existingCheck = await github.getCheckRunForPr(
-          orgSlug,
-          normalizedRepoName,
-          pullRequest.headSha,
-          CHECK_NAME
+      const targetPrs = new Map<
+        string,
+        {
+          repoName: string
+          prNumber: number
+          headSha: string
+        }
+      >()
+      const addTarget = (repoName: string, prNumber: number, headSha: string) => {
+        targetPrs.set(`${repoName}#${prNumber}`, { repoName, prNumber, headSha })
+      }
+
+      if (normalizedRepoName && parsedPrNumber) {
+        const pullRequest = await github.getPullRequest(orgSlug, normalizedRepoName, parsedPrNumber)
+        if (!pullRequest) {
+          autoUpdateSkippedReason = "pull_request_not_found"
+        } else if (!isSignerAuthorForPr(user, pullRequest.authorLogin, pullRequest.authorId)) {
+          autoUpdateSkippedReason = "signer_not_pr_author"
+        } else {
+          addTarget(normalizedRepoName, parsedPrNumber, pullRequest.headSha)
+        }
+      }
+
+      const openPrs = await github.listOpenPullRequestsForOrganization(orgSlug)
+      for (const pr of openPrs) {
+        if (!isSignerAuthorForPr(user, pr.authorLogin, pr.authorId)) continue
+        addTarget(pr.repoName, pr.number, pr.headSha)
+      }
+
+      if (targetPrs.size === 0 && !autoUpdateSkippedReason) {
+        autoUpdateSkippedReason = "no_open_prs_for_signer"
+      }
+
+      for (const target of targetPrs.values()) {
+        const latestClaCheck = (
+          await github.listCheckRunsForRef(orgSlug, target.repoName, target.headSha)
         )
+          .filter((check) => check.name === CHECK_NAME)
+          .sort((a, b) => b.id - a.id)[0]
 
-        if (existingCheck && existingCheck.conclusion === "failure") {
+        if (latestClaCheck && latestClaCheck.conclusion !== "success") {
           const updated = await github.updateCheckRun({
             owner: orgSlug,
-            repo: normalizedRepoName,
-            check_run_id: existingCheck.id,
+            repo: target.repoName,
+            check_run_id: latestClaCheck.id,
             status: "completed",
             conclusion: "success",
             output: {
               title: "CLA: Signed",
-              summary: `@${user.githubUsername} has signed the CLA. Check updated automatically.`,
+              summary: `@${user.githubUsername} has signed CLA version \`${versionLabel}\`.`,
             },
           })
           updatedChecks.push(updated)
         }
 
         const existingComment = await github.findBotComment(
           orgSlug,
-          normalizedRepoName,
-          parsedPrNumber
+          target.repoName,
+          target.prNumber
         )
-        if (
-          existingComment &&
-          (existingComment.body.includes("Contributor License Agreement Required") ||
-            existingComment.body.includes("Re-signing Required"))
-        ) {
-          await github.updateComment({
+        if (existingComment && isRemovableClaPromptComment(existingComment.body)) {
+          await github.deleteComment({
             owner: orgSlug,
-            repo: normalizedRepoName,
+            repo: target.repoName,
             comment_id: existingComment.id,
-            body: generateSignedComment({
-              prAuthor: user.githubUsername,
-              orgName: org.name,
-              claVersionLabel: versionLabel,
-              appBaseUrl: appBaseUrl ?? getAppBaseUrl(),
-            }),
           })
-          updatedCommentId = existingComment.id
+          deletedCommentIds.push(existingComment.id)
         }
       }
+
+      if (targetPrs.size > 0) {
+        autoUpdateSkippedReason = null
+      }
     } catch (err) {
       console.error("Failed to auto-update GitHub PR status after signing:", err)
+      autoUpdateSkippedReason = "auto_update_failed"
     }
   }
 
   return {
     signature,
     updatedChecks,
-    updatedCommentId,
+    deletedCommentIds,
     autoUpdateSkippedReason,
   }
 }
@@ -314,3 +330,22 @@ function hashIpAddress(source: string | null) {
   if (!secret || !source) return null
   return createHmac("sha256", secret).update(source).digest("hex")
 }
+
+function isSignerAuthorForPr(
+  user: Pick<SignClaUser, "githubId" | "githubUsername">,
+  prAuthorLogin: string,
+  prAuthorId?: number
+) {
+  if (typeof prAuthorId === "number" && user.githubId) {
+    return String(prAuthorId) === String(user.githubId)
+  }
+  return prAuthorLogin.trim().toLowerCase() === user.githubUsername.trim().toLowerCase()
+}
+
+function isRemovableClaPromptComment(commentBody: string) {
+  return (
+    commentBody.includes("Contributor License Agreement Required") ||
+    commentBody.includes("Re-signing Required") ||
+    commentBody.includes("CLA Bot is not configured for this repository")
+  )
+}

lib/github/client.ts

@@ -18,6 +18,7 @@ import type {
   IssueComment,
   CreateCommentParams,
   UpdateCommentParams,
+  DeleteCommentParams,
   ListCommentsParams,
   PullRequestRef,
   OpenOrganizationPullRequestRef,
@@ -64,6 +65,9 @@ export interface GitHubClient {
   /** Update an existing comment. */
   updateComment(params: UpdateCommentParams): Promise<IssueComment>
 
+  /** Delete an existing comment. */
+  deleteComment(params: DeleteCommentParams): Promise<void>
+
   /** List all comments on a PR/issue. */
   listComments(params: ListCommentsParams): Promise<IssueComment[]>
 

lib/github/index.ts

@@ -23,6 +23,7 @@ export type {
   UpdateCheckRunParams,
   CreateCommentParams,
   UpdateCommentParams,
+  DeleteCommentParams,
   ListCommentsParams,
   PullRequestRef,
   OpenOrganizationPullRequestRef,

lib/github/mock-github-client.ts

@@ -18,6 +18,7 @@ import type {
   IssueComment,
   CreateCommentParams,
   UpdateCommentParams,
+  DeleteCommentParams,
   ListCommentsParams,
   PullRequestRef,
   OpenOrganizationPullRequestRef,
@@ -239,6 +240,12 @@ export class MockGitHubClient implements GitHubClient {
     return { ...rest }
   }
 
+  async deleteComment(params: DeleteCommentParams): Promise<void> {
+    const idx = comments.findIndex((c) => c.id === params.comment_id)
+    if (idx === -1) throw new Error(`Comment ${params.comment_id} not found`)
+    comments.splice(idx, 1)
+  }
+
   async listComments(params: ListCommentsParams): Promise<IssueComment[]> {
     return comments
       .filter(

lib/github/octokit-client.ts

@@ -16,6 +16,7 @@ import type {
   IssueComment,
   CreateCommentParams,
   UpdateCommentParams,
+  DeleteCommentParams,
   ListCommentsParams,
   PullRequestRef,
   OpenOrganizationPullRequestRef,
@@ -179,6 +180,14 @@ export class OctokitGitHubClient implements GitHubClient {
     return this.mapComment(data)
   }
 
+  async deleteComment(params: DeleteCommentParams): Promise<void> {
+    await this.octokit.rest.issues.deleteComment({
+      owner: params.owner,
+      repo: params.repo,
+      comment_id: params.comment_id,
+    })
+  }
+
   async listComments(params: ListCommentsParams): Promise<IssueComment[]> {
     const { data } = await this.octokit.rest.issues.listComments({
       owner: params.owner,

lib/github/types.ts

@@ -96,6 +96,12 @@ export type UpdateCommentParams = {
   body: string
 }
 
+export type DeleteCommentParams = {
+  owner: string
+  repo: string
+  comment_id: number
+}
+
 export type ListCommentsParams = {
   owner: string
   repo: string

tests/integration/api-suite.test.ts

@@ -1042,16 +1042,67 @@ test("Webhook: after signing, check auto-updates to success (no /recheck needed)
   assert(signData.updatedChecks !== undefined, "updatedChecks returned")
   assert(signData.updatedChecks.length > 0, "at least one check was auto-updated")
   assertEqual(signData.updatedChecks[0].conclusion, "success", "check auto-updated to success")
+  assert(Array.isArray(signData.deletedCommentIds), "deletedCommentIds returned")
+  assert(signData.deletedCommentIds.length > 0, "stale CLA prompt comment was deleted")
 
-  // Step 5: Verify the bot comment was also updated to show "CLA Signed"
+  // Step 5: Verify stale CLA comment is deleted after signing.
   const getRes = await fetch(
     `${baseUrl}/api/webhook/github?orgSlug=fiveonefour&repoName=sdk&prNumber=20`
   )
   const getData = await getRes.json()
-  assert(
-    getData.comment === null || getData.comment.commentMarkdown.includes("CLA Signed"),
-    "comment updated to signed status"
+  assertEqual(getData.comment, null, "stale comment deleted")
+})
+
+test("Webhook: signing without repo/pr still updates open PR check and deletes stale comment", async (baseUrl) => {
+  await resetDb(baseUrl)
+
+  // Step 1: contributor1 opens PR while signed current -> success
+  await sendWebhook(
+    baseUrl,
+    "pull_request",
+    makePrPayload({
+      action: "opened",
+      prAuthor: "contributor1",
+      orgSlug: "fiveonefour",
+      repoName: "sdk",
+      prNumber: 77,
+    })
+  )
+
+  // Step 2: CLA update makes signature stale, /recheck forces failure + prompt comment.
+  await updateClaForOrg("fiveonefour", "# Updated CLA v2 for global sign sync")
+  const { data: recheckData } = await sendWebhook(baseUrl, "issue_comment", {
+    action: "created",
+    comment: { body: "/recheck", user: { login: "orgadmin" } },
+    issue: {
+      number: 77,
+      user: { login: "contributor1", id: 1002 },
+      pull_request: { url: "https://api.github.com/repos/fiveonefour/sdk/pulls/77" },
+    },
+    repository: { owner: { login: "fiveonefour" }, name: "sdk" },
+    installation: { id: 11111 },
+  })
+  assertEqual(recheckData.check.status, "failure", "recheck fails after CLA update")
+  assert(recheckData.comment?.id, "stale comment is present before signing")
+
+  // Step 3: Sign WITHOUT repo/pr context.
+  await switchRole(baseUrl, "contributor")
+  const signRes = await fetch(`${baseUrl}/api/sign`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ orgSlug: "fiveonefour" }),
+  })
+  const signData = await signRes.json()
+  assertEqual(signRes.status, 200, "sign succeeded")
+  assert(signData.updatedChecks.length > 0, "open PR check auto-updated")
+  assert(signData.deletedCommentIds.length > 0, "stale comment deleted")
+
+  // Step 4: Verify no CLA bot comment remains on that PR.
+  const getRes = await fetch(
+    `${baseUrl}/api/webhook/github?orgSlug=fiveonefour&repoName=sdk&prNumber=77`
   )
+  const getData = await getRes.json()
+  assertEqual(getData.comment, null, "no CLA comment remains after signing")
 })
 
 // -- Scenario 3: Non-member, signed old version -> red check + re-sign comment --
@@ -1113,6 +1164,13 @@ test("Webhook: re-sign flow -- sign auto-updates check + comment", async (baseUr
   assertEqual(signRes.status, 200, "re-sign succeeded")
   assert(signData.updatedChecks.length > 0, "check auto-updated after re-sign")
   assertEqual(signData.updatedChecks[0].conclusion, "success", "check is now success")
+  assert(signData.deletedCommentIds.length > 0, "re-sign prompt comment deleted")
+
+  const getRes = await fetch(
+    `${baseUrl}/api/webhook/github?orgSlug=fiveonefour&repoName=sdk&prNumber=30`
+  )
+  const getData = await getRes.json()
+  assertEqual(getData.comment, null, "stale re-sign comment removed")
 })
 
 // -- Scenario 4: Non-member, signed latest version -> green check, NO comment --