From f5d0e8dd179a007a0878b2fb508985ab6e1b66ff Mon Sep 17 00:00:00 2001
From: Matt Kane <mkane@cloudflare.com>
Date: Mon, 6 Apr 2026 07:29:55 +0100
Subject: [PATCH] fix(ci): query check runs instead of commit statuses for CLA
 labels (#289)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(ci): query check runs instead of commit statuses for CLA labels

The CLA Assistant action (contributor-assistant/github-action) reports
results as check runs, not commit statuses. The labeling step was
querying listCommitStatusesForRef which always returned an empty array,
so CLA labels were never applied to PRs.

Switch to checks.listForRef and match on the CLAssistant check run name
and conclusion. Add checks: read permission.

* fix(ci): split CLA labeling into separate job to avoid race condition

The label step was in the same job as the CLA check, so the CLAssistant
check run was still in_progress when queried — labels were never applied.
Move labeling to a separate job with needs: CLAssistant so the check run
is completed before we read its conclusion.

Also add issues: write permission for creating repo-level labels.
---
 .github/workflows/cla.yml | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 18c553a..14c880c 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -8,7 +8,9 @@ on:
 
 permissions:
   actions: write
+  checks: read
   contents: write
+  issues: write
   pull-requests: write
   statuses: write
 
@@ -28,8 +30,12 @@ jobs:
           allowlist: dependabot[bot]
           lock-pullrequest-aftermerge: false
 
+  label:
+    needs: CLAssistant
+    if: always() && (github.event_name == 'pull_request_target' || github.event.issue.pull_request)
+    runs-on: ubuntu-latest
+    steps:
       - name: Label CLA status
-        if: always() && (github.event_name == 'pull_request_target' || github.event.issue.pull_request)
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
@@ -42,14 +48,14 @@ jobs:
             // Get the PR to read head SHA
             const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: prNumber });
 
-            // Read the CLA commit status
-            const { data: statuses } = await github.rest.repos.listCommitStatusesForRef({
+            // Read the CLA check run (the CLA Assistant uses check runs, not commit statuses)
+            const { data: checkRuns } = await github.rest.checks.listForRef({
               owner, repo, ref: pr.head.sha,
             });
-            const claStatus = statuses.find(s => s.context === 'license/cla');
-            if (!claStatus) return;
+            const claCheck = checkRuns.check_runs.find(cr => cr.name === 'CLAssistant');
+            if (!claCheck || claCheck.status !== 'completed') return;
 
-            const signed = claStatus.state === 'success';
+            const signed = claCheck.conclusion === 'success';
             const addLabel = signed ? 'cla: signed' : 'cla: needed';
             const removeLabel = signed ? 'cla: needed' : 'cla: signed';