From 2136970ba0f2e88edc1475e2de70348e3ccaf57f Mon Sep 17 00:00:00 2001 From: robert-inkeep <123133375+robert-inkeep@users.noreply.github.com> Date: Mon, 20 Jul 2026 15:35:02 -0400 Subject: [PATCH] fix: check public PR CLA in OSS bridge auto-merge (#2759) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix: check public PR CLA in OSS bridge auto-merge Update the public PR auto-merge gate to resolve bridged OSS PRs against their original public PRs instead of treating the internal bridge commit as authoritative. For Open Knowledge, read license/cla from the original public PR head SHA and require success there. Scope the oss-sync App token to all OSS mirror repos, validate bridge markers against the public-pr branch slug, and accept all four OSS mirror branch prefixes. Add Mermaid Wysiwyg’s missing public PR bridge workflow/script so it follows the same intake path as the other OSS mirrors. Refresh bridge docs/runbook references and add regression coverage for public-PR CLA lookup, marker drift, and all OSS branch slugs. * address comment * address more comments GitOrigin-RevId: 6b957df9827351fc75b29c0f918758d128348a5d --- .github/scripts/bridge-public-pr-to-monorepo.mjs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/scripts/bridge-public-pr-to-monorepo.mjs b/.github/scripts/bridge-public-pr-to-monorepo.mjs index 3040d9615..dec4a1bd0 100644 --- a/.github/scripts/bridge-public-pr-to-monorepo.mjs +++ b/.github/scripts/bridge-public-pr-to-monorepo.mjs @@ -11,10 +11,11 @@ import { applyClaGate } from './cla-gate.mjs'; // Sibling bridge copies: // - public/agents/.github/scripts/bridge-public-pr-to-monorepo.mjs // - public/agents-optional-local-dev/.github/scripts/bridge-public-pr-to-monorepo.mjs +// - public/mermaid-wysiwyg/.github/scripts/bridge-public-pr-to-monorepo.mjs // The Open Knowledge copy additionally imports a co-located `cla-gate.mjs` for // contributor-CLA enforcement — an OK-only divergence. That module ships to the // same repo via Copybara, so the import resolves on the mirror; the "no shared -// code" rule still holds (no module is shared ACROSS the three repos). +// code" rule still holds (no module is shared ACROSS the public repos). // The OK copy also routes 3-way-apply conflicts to a draft maintainer PR rather // than hard-failing (the OK mirror strips comments, so contributor patches // conflict against the comment-rich internal tree); the sibling copies keep the