decibri/decibri CLA

Enforce individual and corporate Contributor License Agreements on pull requests. No server, no database.

Trust Signals

name	description	required	default
store-token	Token with contents read and write on the decibri/decibri-cla store repository, used to read and append the signature and company data files. Source this from a secret such as CLA_STORE_TOKEN. Never pass a broadly scoped token.	yes	—
github-token	Token for the calling repository, used to read pull request context and to set the CLA check, post comments, and lock merged pull requests. Defaults to the workflow GITHUB_TOKEN.	no	${{ github.token }}
store-repo	Full name (owner/repo) of the signature store repository that holds the config, agreement texts, and signature data. Defaults to decibri/decibri-cla.	no	decibri/decibri-cla
dry-run	When true, evaluate and log the coverage decision without writing any check, comment, or signature. Use this to validate against a live repository before enforcement is switched on.	no	false

no outputs