Add CLA Signature bot

[Gudahtt]

The CLA signature bot will check the authors of each PR to ensure they have all signed the CLA. If any authors still need to sign the CLA, it will leave a comment explaining how it can be signed, and will check back upon each comment to see if it has been signed.

The bot used is Metamask/cla-signature-bot, which is a fork of Roblox/cla-signature-bot. The fork has a couple of improvements, and it updated the PR comment text to be more appropriate for our usage.

Currently the only whitelisted user is dependabot, meaning that even ConsenSys employees will need to sign the CLA. We could add all employees to the whitelist, but I figured it'd be easier to get everyone to sign individually rather than maintaining this list here.

The signatures are stored in cla.json on the cla-signatures branch, which is in this repository as a distinct root. We can consider moving this to a separate repository in the future - this was just easier to setup.

[Gudahtt]

Note that actions haven't yet been enabled on this repo, and even if they had, it wouldn't work properly yet because of my use of the pull_request_target event trigger (which only uses actions that are in the base branch).

[Gudahtt]

Currently the workflow for first-time contributors/signers requires the action to be manually re-run unfortunately. It's supposed to update automatically after the author signs, but it doesn't seem to be working correctly. Instead of re-running, the job gets queued up again but never executes (probably a GitHub bug? 🤔). Manually re-running once per contributor isn't terrible though.

[metamaskbot]

Builds ready [6015a3f]

• builds: chrome, firefox, opera
• bundle viz: background, ui, inpage, contentscript, ui-libs, bg-libs, phishing-detect
• dep viz: background
• all artifacts

Page Load Metrics (486 ± 65 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	30	103	44	21	10
		domContentLoaded	314	686	484	136	65
		load	315	687	486	136	65
		domInteractive	314	685	484	136	66

[Gudahtt]

I have just added a branch protection rule for the cla-signatures branch. I couldn't enable any of the options like requiring status checks (as the action must be allowed to push directly to that branch), but at least it prevents deletion and force pushes and non-linear history.

[Gudahtt]

Note that actions triggered by the pull_request_target event are automatically added as status checks. We can make this a required status check after this is merged.

Screenshot:

[rekmarks]

LGTM, just one language-related nit.

[Gudahtt]

I just noticed that I'm seeing this problem on my fork when testing this: Roblox/cla-signature-bot#10

I'm going to try to fix this as well. This would really clutter up the actions tab.

[metamaskbot]

Builds ready [5c16eda]

• builds: chrome, firefox, opera
• bundle viz: background, ui, inpage, contentscript, ui-libs, bg-libs, phishing-detect
• dep viz: background
• all artifacts

Page Load Metrics (485 ± 69 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	29	84	40	15	7
		domContentLoaded	264	694	483	143	69
		load	266	696	485	143	69
		domInteractive	264	694	483	143	69

[Gudahtt]

This should be ready to review again now. I've addressed the issue comment problem in 5c16eda by skipping the job if it was triggered by an issue comment rather than a PR comment. Unfortunately this still ends up showing up in the 'Actions' tab, but at least it's greyed out. This was the best solution I could find. It doesn't seem possible yet to trigger actions just on pull request comments but not on issue comments.

[Gudahtt]

Also I'd appreciate a review of the commits I've made on cla-signature-bot: https://github.com/MetaMask/cla-signature-bot/commits/master

Most of them have accompanying PRs here: https://github.com/Roblox/cla-signature-bot/pulls
The one exception is MetaMask/cla-signature-bot@83d45d2 - which isn't yet sufficiently generalized to submit back upstream.

[metamaskbot]

Builds ready [485431c]

• builds: chrome, firefox, opera
• bundle viz: background, ui, inpage, contentscript, ui-libs, bg-libs, phishing-detect
• dep viz: background
• all artifacts

Page Load Metrics (510 ± 83 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	30	99	42	16	8
		domContentLoaded	292	833	508	173	83
		load	293	835	510	173	83
		domInteractive	292	833	508	173	83

[rekmarks]

LGTM!

[Gudahtt]

I have added one more feature to cla-signature-bot: the allowOrganizationMembers flag. This ensures that none of us need to sign the CLA.

[metamaskbot]

Builds ready [0dc2f2e]

• builds: chrome, firefox, opera
• bundle viz: background, ui, inpage, contentscript, ui-libs, bg-libs, phishing-detect
• dep viz: background
• all artifacts

Page Load Metrics (503 ± 73 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	31	97	44	20	10
		domContentLoaded	261	755	501	152	73
		load	263	756	503	152	73
		domInteractive	261	755	501	152	73

[whymarrh]

I've enabled local actions for this repo—I had disabled actions across all the repos a while back before we'd decided to start using them so as we add workflows we'll need to enable it.

Where we're using our fork I've left it at just local actions but it might even be good to try and stick to local actions so we don't have random third-party code running on CI.

[Gudahtt]

I'm going to disable actions again for now until we get final signoff on this CLA.

I'm not sure if we need to enable third-party actions for issue_comment to work correctly 🤔 I suppose even PRs from forks are considered a part of this repository? I guess we'll find out.

[whymarrh]

I think that simply restricts where we can uses code from. That is, our uses: MetaMask/[email protected] versus uses: roblox/[email protected].

[Gudahtt]

Note that I've just pushed one more commit to this branch (hopefully the final one 🤞 ). I had discovered a couple of mistakes when testing, and they are now fixed.

Also I've discovered that the allow-organization-members flag only works for anyone who is a public member of the organization. This means that any private members will need to either become public or sign the CLA. This seems fine though - if anything it's a good thing, as now we aren't leaking private information via this bot's behavior.

[metamaskbot]

Builds ready [85b03a6]

• builds: chrome, firefox, opera
• bundle viz: background, ui, inpage, contentscript, ui-libs, bg-libs, phishing-detect
• dep viz: background
• all artifacts

Page Load Metrics (481 ± 65 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	29	80	39	11	5
		domContentLoaded	260	713	479	135	65
		load	261	715	481	135	65
		domInteractive	260	713	479	135	65

[Gudahtt]

I have just enabled local Actions for this repository (as described in this comment), so the bot should start posting now.