cla.yml

# Copyright (c) 2026 Santander Group
# SPDX-License-Identifier: Apache-2.0
#
# Contributor License Agreement check using CLA Assistant Lite
# (https://github.com/contributor-assistant/github-action).
#
# Signatures are stored in THIS repository under .cla-signatures/v1/cla.json,
# so the default GITHUB_TOKEN is sufficient and no PAT is required.
# The CLA document itself lives in https://github.com/SantanderAI/cla.

name: CLA Assistant

on:
  issue_comment:
    types: [created]
  pull_request_target:
    types: [opened, closed, synchronize]

# contents: write is required so the bot can commit the signature file back;
# all permissions are granted at job level only (top-level default: none).
permissions: {}

jobs:
  cla:
    name: CLA Assistant
    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: write
      pull-requests: write
      statuses: write
    if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
    steps:
      - name: CLA Assistant
        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08  # v2.6.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          path-to-signatures: ".cla-signatures/v1/cla.json"
          path-to-document: "https://github.com/SantanderAI/cla/blob/main/CLA.md"
          branch: cla-signatures
          allowlist: dependabot[bot],opensource-SantanderAI