fix: use collaborator check and CLA_ACCESS_TOKEN for membership verification

[Copilot]

The CLA workflow incorrectly required org members to sign the CLA because GITHUB_TOKEN lacks read:org scope, causing the /orgs/knitli/members/{user} API to return 404 for valid members.

Changes

• Add repository collaborator check first: Use /repos/{owner}/{repo}/collaborators/{user} with GITHUB_TOKEN (works for repo-level permissions)
• Fallback to org membership check: Use CLA_ACCESS_TOKEN (has org:read scope) for the org membership API
• Add validation and error handling: Check token availability, handle 204/404/302/error responses appropriately

Before

# Always used GITHUB_TOKEN for org check - returns 404 for members
response=$(curl -s -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
  "https://api.github.com/orgs/knitli/members/$user")

After

# 1. Check collaborator status (works with GITHUB_TOKEN)
collab_response=$(curl ... "https://api.github.com/repos/$REPO/collaborators/$user")

# 2. Fallback: Check org membership (requires CLA_ACCESS_TOKEN with org:read)
if [ -n "$CLA_ACCESS_TOKEN" ]; then
  org_response=$(curl -H "Authorization: Bearer $CLA_ACCESS_TOKEN" \
    "https://api.github.com/orgs/knitli/members/$user")
fi

Original prompt

We've attempted to fix a persistent issue with CLA Check. We're getting closer but it's still producing undesirable results.

I want you to review, as an example, the following PR:
knitli/codeweaver#185

• You'll see that the first message it gives correctly indicates that no one needs to sign the CLA.
• Then a later message says the exact same people need to sign the CLA.

(.github/workflows/cla-check.yml)

Please help get this fixed!

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR fixes a critical issue in the CLA workflow where organization members were incorrectly required to sign the CLA. The root cause was that the standard GITHUB_TOKEN lacks the read:org scope needed to verify organization membership via the /orgs/knitli/members/{user} API, causing it to return 404 even for valid members.

Key Changes:

• Implements a two-tier verification approach: first checking repository collaborator status (using GITHUB_TOKEN), then falling back to org membership (using CLA_ACCESS_TOKEN with org:read scope)
• Adds the CLA_ACCESS_TOKEN environment variable to enable org membership verification with proper permissions
• Improves error handling for different API response scenarios (204/404/302/errors)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The comment states "This API returns 204 if user has push access, 404 otherwise", but the GitHub collaborators API actually returns 204 if the user has any collaborator permission (read, write, or admin), not just push/write access. Consider updating the comment to: "This API returns 204 if user is a collaborator (read/write/admin), 404 otherwise"

Suggested change

	# This API returns 204 if user has push access, 404 otherwise
	# This API returns 204 if user is a collaborator (read/write/admin), 404 otherwise

[Copilot]

The 302 status code typically indicates a redirect and often suggests an authentication issue rather than a definitive "not a member" response. Treating 302 the same as 404 might incorrectly categorize authentication failures as "not a member". Consider treating 302 as an error case (moving it to the else block on line 179) to fail securely when authentication issues occur: elif [ "$org_response" == "404" ]; then

Suggested change

	elif [ "$org_response" == "404" ] || [ "$org_response" == "302" ]; then
	# 404 = not a member, 302 = requester is not an org member (can't see membership)
	echo "User $user is NOT a collaborator or org member and may require CLA"
	NEEDS_CLA+=("$user")
	else
	# API error (rate limit, network issue, etc.) - fail open and require CLA
	elif [ "$org_response" == "404" ]; then
	# 404 = not a member
	echo "User $user is NOT a collaborator or org member and may require CLA"
	NEEDS_CLA+=("$user")
	else
	# API error (rate limit, network issue, 302 redirect, etc.) - fail open and require CLA

[Copilot]

This comment should be updated to clarify that 302 indicates an authentication/redirect issue rather than membership visibility. If the logic is changed to treat 302 as an error case, update to: # 404 = not a member or membership is concealed

Suggested change

	# 404 = not a member, 302 = requester is not an org member (can't see membership)
	# 404 = not a member or membership is concealed, 302 = authentication/redirect issue (requester is not an org member, cannot see membership)