incursa/Incursa Contributor Agreement
Checks pull request contributors against a centralized contributor agreement signature store.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | Token for the repository receiving the pull request. Use secrets.GITHUB_TOKEN. | yes | — |
| storage-token | Token with read/write Contents permission for the private signature storage repository. | yes | — |
| storage-owner | Owner of the private signature storage repository. | yes | — |
| storage-repo | Name of the private signature storage repository. | yes | — |
| storage-path | JSON file path inside the storage repository. | no | signatures/incursa-contributor-agreement-v1.json |
| storage-branch | Branch in the storage repository where signatures are stored. | no | main |
| agreement-id | Stable identifier for the agreement version being signed. | no | incursa-contributor-agreement-v1 |
| agreement-url | Public URL of the contributor agreement document. | yes | — |
| signature-comment | Exact pull request comment text that records a signature. | no | I have read the Incursa Contributor Agreement and I hereby assign my contribution rights as described. |
| recheck-comment | Pull request comment text that re-runs the check without recording a signature. | no | recheck contributor agreement |
| allowlist | Comma-separated GitHub logins or wildcard patterns that do not need to sign. | no | dependabot[bot],github-actions[bot],renovate[bot] |
| status-context | Commit status context to publish on the pull request head SHA. | no | Contributor Agreement |
| fail-on-unlinked-commit-author | Whether commits that are not linked to a GitHub user should fail the check. | no | true |
Outputs
| name | description |
|---|---|
| signed | true when every required contributor has signed. |
| missing | Comma-separated GitHub logins still missing signatures. |