fix(ci): query check runs instead of commit statuses for CLA labels (#289)

* fix(ci): query check runs instead of commit statuses for CLA labels

The CLA Assistant action (contributor-assistant/github-action) reports
results as check runs, not commit statuses. The labeling step was
querying listCommitStatusesForRef which always returned an empty array,
so CLA labels were never applied to PRs.

Switch to checks.listForRef and match on the CLAssistant check run name
and conclusion. Add checks: read permission.

* fix(ci): split CLA labeling into separate job to avoid race condition

The label step was in the same job as the CLA check, so the CLAssistant
check run was still in_progress when queried — labels were never applied.
Move labeling to a separate job with needs: CLAssistant so the check run
is completed before we read its conclusion.

Also add issues: write permission for creating repo-level labels.

.github/workflows/cla.yml

@@ -8,7 +8,9 @@ on:
 
 permissions:
   actions: write
+  checks: read
   contents: write
+  issues: write
   pull-requests: write
   statuses: write
 
@@ -28,8 +30,12 @@ jobs:
           allowlist: dependabot[bot]
           lock-pullrequest-aftermerge: false
 
+  label:
+    needs: CLAssistant
+    if: always() && (github.event_name == 'pull_request_target' || github.event.issue.pull_request)
+    runs-on: ubuntu-latest
+    steps:
       - name: Label CLA status
-        if: always() && (github.event_name == 'pull_request_target' || github.event.issue.pull_request)
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
@@ -42,14 +48,14 @@ jobs:
             // Get the PR to read head SHA
             const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: prNumber });
 
-            // Read the CLA commit status
+            // Read the CLA check run (the CLA Assistant uses check runs, not commit statuses)
-            const { data: statuses } = await github.rest.repos.listCommitStatusesForRef({
+            const { data: checkRuns } = await github.rest.checks.listForRef({
               owner, repo, ref: pr.head.sha,
             });
-            const claStatus = statuses.find(s => s.context === 'license/cla');
+            const claCheck = checkRuns.check_runs.find(cr => cr.name === 'CLAssistant');
-            if (!claStatus) return;
+            if (!claCheck || claCheck.status !== 'completed') return;
 
-            const signed = claStatus.state === 'success';
+            const signed = claCheck.conclusion === 'success';
             const addLabel = signed ? 'cla: signed' : 'cla: needed';
             const removeLabel = signed ? 'cla: needed' : 'cla: signed';