You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: WHITELISTING_BOTS.md
+27-22Lines changed: 27 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,33 +6,35 @@ This can be done on the GitHub organization level by setting the `skip_cla` prop
6
6
7
7
Replace `{stage}` with either `dev` or `prod`.
8
8
9
-
This property is a Map attribute that contains mapping from repository pattern to bot username (GitHub login), email and name pattern.
9
+
This property is a Map attribute that contains mapping from repository pattern to bot GitHub login, email and name pattern.
10
10
11
-
Example `username/login` is `lukaszgryglicki` (like any `username/login` that can be accessed via `https://github.com/username`).
11
+
Example `login` is `lukaszgryglicki` (like any `login` that can be accessed via `https://github.com/login`).
12
+
13
+
This is sometimes called `username` but we use `login` to avoid confusion with the `name` attribute.
12
14
13
15
Example name is `"Lukasz Gryglicki"`.
14
16
15
17
Email pattern and name pattern are optional and `*` is assumed for them if not specified.
16
18
17
19
Each pattern is a string and can be one of three possible types (and are checked tin this order):
18
-
-`"name"` - exact match for repository name, GitHub login/username, email address, GitHub name.
19
-
-`"re:regexp"` - regular expression match for repository name, GitHub username, or email address.
20
+
-`"name"` - exact match for repository name, GitHub login, email address, GitHub name.
21
+
-`"re:regexp"` - regular expression match for repository name, GitHub login, name, or email address.
20
22
-`"*"` - matches all.
21
23
22
-
So the format is like `"repository_pattern": "github_username_pattern;email_pattern;name_pattern"`. `;` is used as a separator.
24
+
So the format is like `"repository_pattern": "login_pattern;email_pattern;name_pattern"`. `;` is used as a separator.
23
25
24
26
You can also specify multiple patterns so different set is used for multiple users - in such case configuration must start with `[`, end with `]` and be `||` separated.
25
27
26
28
For example: `"[copilot-swe-agent[bot];*;*||re:(?i)^l(ukasz)?gryglicki$;*;re:Gryglicki]"`.
27
29
28
-
Full format is like `"repository_pattern": "[github_username_pattern;email_pattern;name_pattern||..]"`.
30
+
Full format is like `"repository_pattern": "[login_pattern;email_pattern;name_pattern||..]"`.
29
31
30
32
Other complex example: `"re:(?i)^repo\d*$": "[veerendra||re:(?i)^l(ukasz)?gryglicki$;[email protected]||*;*;Lukasz Gryglicki]"`.
31
33
32
34
This matches one of:
33
-
- GitHub username/login `veerendra` no matter the email and name.
34
-
- GitHub username/login like lgryglicki, LukaszGryglicki and similar with email [email protected], name doesn't matter.
35
-
- GitHub name "Lukasz Gryglicki" email and username/login doesn't matter.
35
+
- GitHub login `veerendra` no matter the email and name.
36
+
- GitHub login like lgryglicki, LukaszGryglicki and similar with email [email protected], name doesn't matter.
37
+
- GitHub name "Lukasz Gryglicki" email and login doesn't matter.
36
38
37
39
There can be multiple entries under one Github Organization DynamoDB entry.
For example for `copilot-swe-agent[bot]` GitHub bot the exact values returned by GitHub are: id, login, name are all nulls, email is like this `[email protected]`.
63
+
60
64
Algorithm to match pattern is as follows:
61
65
- First we check repository name for exact match. Repository name is without the organization name, so for `https://github.com/linuxfoundation/easycla` it is just `easycla`. If we find an entry in `skip_cla` for `easycla` that entry is used and we stop searching.
62
66
- If no exact match is found, we check for regular expression match. Only keys starting with `re:` are considered. If we find a match, we use that entry and stop searching.
63
67
- If no match is found, we check for `*` entry. If it exists, we use that entry and stop searching.
64
68
- If no match is found, we don't skip CLA check.
65
-
- Now when we have the entry, it is in the following format: `github_username_pattern;email_pattern;name_pattern` or `"[github_username_pattern;email_pattern;name_pattern||...]" (array)`.
66
-
- We check GitHub username/login, email address and name against the patterns. Algorithm is the same - username, email and name patterns can be either direct match or `re:regexp` or `*`.
67
-
- If username, email and name match the patterns, we skip CLA check. If username or email or name is not set but the pattern is `*` it means hit.
68
-
- So setting pattern to `username_pattern;*;*` or `username_pattern` (which is equivalent) means that we only check for username match and assume all emails and names are valid.
69
+
- Now when we have the entry, it is in the following format: `login_pattern;email_pattern;name_pattern` or `"[login_pattern;email_pattern;name_pattern||...]" (array)`.
70
+
- We check GitHub login, email address and name against the patterns. Algorithm is the same - login, email and name patterns can be either direct match or `re:regexp` or `*`.
71
+
- If login, email and name match the patterns, we skip CLA check. If login, email or name is not set but the pattern is `*` it means hit.
72
+
- So setting pattern to `login_pattern;*;*` or `login_pattern` (which is equivalent) means that we only check for login match and assume all emails and names are valid.
69
73
- Any actor that matches any of the entries in the array will be skipped (logical OR).
70
-
- If we set `repo_pattern` to `*` it means that this configuration applies to all repositories in the organization. If there are also specific repository patterns, they will be used instead of `*` (fallback for all).
74
+
- If we set `repo_pattern` to `*` it means that this configuration applies to all repositories in the organization.
75
+
- If there are also specific repository patterns, they will be used instead of `*` (fallback for all).
71
76
72
77
73
78
There is a script that allows you to update the `skip_cla` property in the DynamoDB table. It is located in `utils/skip_cla_entry.sh`. You can run it like this:
0 commit comments