fix(ci): stop the CLA gate silently dropping valid signatures

[madarco]

The bug

@francoluxor signed the CLA on #296, two minutes after the bot asked:

I have read the CLA Document and I hereby sign the CLA**.**

That trailing period cost them the signature. The workflow run that fired on the comment (30650537003) came back skipped — signatures/v1/cla.json still lists only madarco, and the stale failing check from the original pull_request_target run kept the PR blocked. #296 needed an --admin merge.

There are two exact-match traps, stacked:

1. The job if compared github.event.comment.body == '…sign the CLA'. Any punctuation, greeting, or trailing whitespace skips the job — so the action never even starts.
2. custom-pr-sign-comment repeats it one layer deeper. In contributor-assistant/github-action@v2.6.1, setting that input switches isCommentSignedByUser from a tolerant regex to a strict compare:

if (getCustomPrSignComment() !== "") {
    return getCustomPrSignComment().toLowerCase() === comment   // comment = body.trim().toLowerCase()
}
// otherwise: /^.*i \s*have \s*read \s*the \s*cla \s*document \s*and \s*i \s*hereby \s*sign \s*the \s*cla.*$/

Relaxing only the if would have let the job run and still fail.

The fix

• contains instead of == on the job if.
• Drop custom-pr-sign-comment so the action's own forgiving regex applies. getPrSignComment() falls back to the byte-identical default phrase, so nothing user-visible changes.
• Guard on the comment author — the bot's "please sign" message quotes the phrase, which contains would otherwise match. (isCommentSignedByUser already refuses to credit github-actions[bot], so this only saves a wasted run.)

Failure mode this removes: a contributor signs, sees nothing happen, and has no way to tell whether they got the wording wrong or the check is just slow.

https://claude.ai/code/session_0131uzfwtjgE8rjkoFToQhuK

---

Note

Low Risk
CI-only CLA workflow tuning; no application runtime, auth, or data-path changes.

Overview
Fixes CLA signatures being ignored when contributors don’t match the sign phrase exactly (e.g. a trailing period), which left the job skipped, never updated signatures/v1/cla.json, and blocked merges with no useful feedback.

The issue_comment job if now uses contains(...) on the sign phrase instead of ==, and ignores comments from github-actions[bot] so the bot’s quoted phrase doesn’t trigger a run. custom-pr-sign-comment is removed so contributor-assistant/github-action keeps its default regex matcher instead of strict string equality on the trimmed body.

^{Reviewed by Cursor Bugbot for commit c726148. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agentbox-web	Ready	Preview	Aug 1, 2026 9:33am