feat: automated cla flow with robust cla requirement check

Author: gitcommitshow

.env.sample

@@ -2,3 +2,4 @@ APP_ID="11"
 GITHUB_APP_PRIVATE_KEY_BASE64="base64 encoded private key"
 PRIVATE_KEY_PATH="very/secure/location/gh_app_key.pem"
 WEBHOOK_SECRET="secret"
+WEBSITE_ADDRESS="https://github.app.home"

app.js

@@ -1,9 +1,11 @@
 import dotenv from "dotenv";
 import fs from "fs";
 import http from "http";
+import url from "url";
 import { Octokit, App } from "octokit";
 import { createNodeMiddleware } from "@octokit/webhooks";
-import { routes } from "./routes.js";
+import { routes } from "./src/routes.js";
+import { getMessage, isCLARequired } from "./src/helpers.js";
 
 // Load environment variables from .env file
 dotenv.config();
@@ -26,7 +28,6 @@ const privateKey =
   );
 const secret = process.env.WEBHOOK_SECRET;
 const enterpriseHostname = process.env.ENTERPRISE_HOSTNAME;
-const messageForNewPRs = fs.readFileSync("./message.md", "utf8");
 
 // Create an authenticated Octokit client authenticated as a GitHub App
 const app = new App({
@@ -54,11 +55,28 @@ app.webhooks.on("pull_request.opened", async ({ octokit, payload }) => {
     `Received a pull request event for #${payload.pull_request.number}`,
   );
   try {
+    if (!isCLARequired(payload.pull_request)) {
+      return;
+    }
+    // If the user is not a member of the organization and haven't yet signed CLA,
+    //  ask them to sign the CLA
     await octokit.rest.issues.createComment({
       owner: payload.repository.owner.login,
       repo: payload.repository.name,
       issue_number: payload.pull_request.number,
-      body: messageForNewPRs,
+      body: getMessage("ask-to-sign-cla", {
+        username: payload.pull_request.user.login,
+        org: payload.repository.owner.login,
+        repo: payload.repository.name,
+        pr_number: payload.pull_request.number,
+      }),
+    });
+    // Add a label to the PR
+    octokit.rest.issues.addLabels({
+      owner: payload.repository.owner.login,
+      repo: payload.repository.name,
+      issue_number: payload.pull_request.number,
+      labels: ["Pending CLA"],
     });
   } catch (error) {
     if (error.response) {
@@ -72,7 +90,9 @@ app.webhooks.on("pull_request.opened", async ({ octokit, payload }) => {
 });
 
 app.webhooks.on("issues.opened", async ({ octokit, payload }) => {
-  console.log(`Received a new issue event for #${payload.issue.number}`);
+  console.log(
+    `Received a new issue event for #${payload.issue.number} by ${pull_request.user.type}: ${pull_request.user.login}`,
+  );
   try {
     await octokit.rest.issues.createComment({
       owner: payload.repository.owner.login,
@@ -118,15 +138,20 @@ const middleware = createNodeMiddleware(app.webhooks, { path });
 
 http
   .createServer((req, res) => {
-    switch (req.method + " " + req.url) {
+    const parsedUrl = url.parse(req.url);
+    const pathWithoutQuery = parsedUrl.pathname;
+    const queryString = parsedUrl.query;
+    console.log(req.method + " " + pathWithoutQuery);
+    if (queryString) console.log(queryString.substring(0, 20) + "...");
+    switch (req.method + " " + pathWithoutQuery) {
       case "GET /":
         routes.home(req, res);
         break;
-      case "GET /form":
-        routes.form(req, res);
+      case "GET /cla":
+        routes.cla(req, res);
         break;
-      case "POST /form":
-        routes.submitForm(req, res);
+      case "POST /cla":
+        routes.submitCla(req, res, app.octokit);
         break;
       case "POST /api/webhook":
         middleware(req, res);

form.html

@@ -1,7 +1,7 @@
 {
-  "name": "starter_github_app",
-  "private": true,
-  "version": "0.0.1",
+  "name": "rudder_github_app",
+  "private": false,
+  "version": "0.0.2",
   "type": "module",
   "scripts": {
     "lint": "standard",
@@ -15,5 +15,8 @@
   "dependencies": {
     "dotenv": "^16.0.3",
     "octokit": "^3.1.2"
+  },
+  "engines": {
+    "node": ">=20"
   }
 }

helpers.js

@@ -0,0 +1,130 @@
+import { storage } from "./storage.js";
+import { resolve, dirname } from "path";
+import url from "url";
+
+const __currentDir = dirname(url.fileURLToPath(import.meta.url)); // Path to directory of this file
+export const PROJECT_ROOT_PATH = resolve(__currentDir, ".."); // Assuming this file is located one folder under root
+
+export function parseUrlQueryParams(urlString) {
+  const url = new URL(urlString);
+  const params = new URLSearchParams(url.search);
+  return Object.fromEntries(params.entries());
+}
+
+export function queryStringToJson(str) {
+  if (!str) {
+    return {};
+  }
+  return str.split("&").reduce((result, item) => {
+    const parts = item.split("=");
+    const key = decodeURIComponent(parts[0]);
+    const value = parts.length > 1 ? decodeURIComponent(parts[1]) : "";
+    result[key] = value;
+    return result;
+  }, {});
+}
+
+export function isCLARequired(pullRequest) {
+  if (isABot(pullRequest.user)) {
+    console.log("This PR is from a bot. So no CLA required.");
+    return false;
+  }
+  if (!isExternalContribution(pullRequest)) {
+    console.log("This PR is an internal contribution. So no CLA required.");
+    return false;
+  }
+  if (isCLASigned(pullRequest.user.login)) {
+    console.log("Author signed CLA already. So no CLA required.");
+    return false;
+  }
+  return true;
+}
+
+export function isExternalContribution(pullRequest) {
+  if (
+    pullRequest?.head?.repo?.full_name !== pullRequest?.base?.repo?.full_name
+  ) {
+    return true;
+  }
+  return false;
+}
+
+export function isABot(user) {
+  if (user?.type === "Bot") {
+    return true;
+  }
+  return false;
+}
+
+export async function isOrgMember(octokit, org, username) {
+  // Check if the is a member of the organization
+  try {
+    await octokit.rest.orgs.checkMembershipForUser({
+      org,
+      username,
+    });
+    return true;
+  } catch (err) {
+    console.log(err);
+    return false;
+  }
+}
+
+export async function afterCLA(octokit, claSignatureInfo) {
+  if (!claSignatureInfo || !claSignatureInfo.referrer) return;
+  const { org, repo, prNumber } = parseUrlQueryParams(
+    claSignatureInfo.referrer,
+  );
+  console.log(
+    `PR related to the CLA - owner: ${org}, repo: ${repo}, prNumber: ${prNumber}`,
+  );
+  if (!org || !repo || !prNumber) {
+    console.log("Not enough info to find the related PR.");
+    return;
+  }
+  try {
+    await octokit.rest.issues.removeLabel({
+      owner: org,
+      repo: repo,
+      issue_number: prNumber,
+      name: "Pending CLA",
+    });
+    console.log("Label 'Pending CLA' removed successfully.");
+  } catch (error) {
+    if (error.response) {
+      console.error(
+        `Error! Status: ${error.response.status}. Message: ${error.response.data.message}`,
+      );
+    } else {
+      console.error(error);
+    }
+  } finally {
+    console.log("Completed post CLA verification tasks");
+  }
+}
+
+export function getMessage(name, payload) {
+  let message = "";
+  switch (name) {
+    case "ask-to-sign-cla":
+      const CLA_LINK =
+        process.env.WEBSITE_ADDRESS +
+        "/cla" +
+        `?org=${payload.org}&repo=${payload.repo}&prNumber=${payload.pr_number}&username=${payload.username}`;
+      message = `Thank you for contributing this PR.
+      Please [sign the Contributor License Agreement (CLA)](${CLA_LINK}) before merging.`;
+      break;
+    default:
+      const filepath = resolve(PROJECT_ROOT_PATH, name + ".md");
+      message = fs.readFileSync(filepath, "utf8");
+  }
+  return message;
+}
+
+export function isCLASigned(username) {
+  const userData = storage.get({ username: username, terms: "on" });
+  if (userData?.length > 0) {
+    return true;
+  }
+  return false;
+}

home.html

@@ -0,0 +1,25 @@
+import fs from "fs";
+import { resolve } from "path";
+
+import { PROJECT_ROOT_PATH } from "./helpers.js";
+
+const dbPath = process.env.DB_PATH || resolve(PROJECT_ROOT_PATH, "db.json");
+
+export const storage = {
+  save(data) {
+    const currentData = JSON.parse(fs.readFileSync(dbPath, "utf8"));
+    currentData.push(data);
+    fs.writeFileSync(dbPath, JSON.stringify(currentData, null, 2));
+  },
+  get(filters) {
+    const currentData = JSON.parse(fs.readFileSync(dbPath, "utf8"));
+    return currentData.filter((item) => {
+      for (const [key, value] of Object.entries(filters)) {
+        if (item[key] !== value) {
+          return false;
+        }
+      }
+      return true;
+    });
+  },
+};