name: 'CLA Assistant'
on:
  issue_comment:
    types: [created]
  pull_request_target:
    types: [opened, closed, synchronize]

# Explicitly configure permissions
permissions:
  actions: write
  contents: write
  pull-requests: write
  statuses: write

jobs:
  CLAAssistant:
    runs-on: ubuntu-latest
    steps:
      - name: 'CLA Assistant'
        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
        uses: contributor-assistant/github-action@v2.6.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          # Path where signatures will be stored
          path-to-signatures: 'signatures/version1/cla.json'

          # Path to your CLA document
          path-to-document: 'https://github.com/browseros-ai/BrowserOS/blob/main/CLA.md'

          # Branch to store signatures (should not be protected)
          branch: 'main'

          # Allowlist for users who don't need to sign (bots, core team members)
          allowlist: shadowfax92,felarof99,dependabot[bot],renovate[bot],github-actions[bot]

          # Optional: Custom messages
          custom-notsigned-prcomment: |
            **CLA Assistant Lite bot** Thank you for your submission! We require contributors to sign our [Contributor License Agreement](https://github.com/browseros-ai/BrowserOS/blob/main/CLA.md) before we can accept your contribution.

            By signing the CLA, you confirm that:
            - You have read and agree to the AGPL-3.0 license terms
            - Your contribution is your original work
            - You grant us the rights to use your contribution under the AGPL-3.0 license

            **To sign the CLA, please comment on this PR with:**
            `I have read the CLA Document and I hereby sign the CLA`

          custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA'

          custom-allsigned-prcomment: |
            **CLA Assistant Lite bot** ✅ All contributors have signed the CLA. Thank you for helping make BrowserOS better!

          # Lock PR after merge to prevent signature tampering
          lock-pullrequest-aftermerge: true

          # Custom commit messages
          create-file-commit-message: 'docs: Create CLA signatures file'
          signed-commit-message: 'docs: $contributorName signed the CLA in $owner/$repo#$pullRequestNo'
