From 69302a5775d7c201cd726e6862106ec1c6c9cc15 Mon Sep 17 00:00:00 2001
From: finalerock44 <77282157+finalerock44@users.noreply.github.com>
Date: Wed, 2 Sep 2026 15:55:36 +0100
Subject: [PATCH] docs(ci): the CLA action fork must stay public

A public repo cannot resolve an action from a private one; the first attempt
failed at resolution even with the org access policy set.
---
 .github/workflows/cla.yml | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 56a1ffa..24fe627 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -7,19 +7,18 @@ name: CLA Assistant
 # by commenting the configured phrase on their PR; the action records it and
 # flips the check green.
 #
-# ACTION SOURCE: devicecloud-dev/cla-assistant-action, a PRIVATE fork of the
-# upstream contributor-assistant/github-action, which was archived read-only on
+# ACTION SOURCE: devicecloud-dev/cla-assistant-action, our fork of the upstream
+# contributor-assistant/github-action, which was archived read-only on
 # 2026-03-23. We forked because GitHub's Node 20 deprecation began force-running
 # node20 actions on Node 24, under which the upstream step does its work, logs
 # "All contributors have signed the CLA", and THEN exits non-zero — failing a
 # required check on every PR (first hit 2026-09-02, last green 2026-08-31). The
 # fork's only change is `using: node24`; dist is unmodified. See its FORK.md.
 #
-# The fork is private, so it relies on Settings -> Actions -> Access ->
-# "Accessible from repositories in the devicecloud-dev organization" being set
-# on THAT repo. Resolution works for outside-contributor PRs because this
-# workflow is `pull_request_target`, so it runs in this repo's context rather
-# than the fork's.
+# The fork must stay PUBLIC: this repo is public, and a public repo's workflow
+# cannot resolve an action from a private one — it fails at resolution with
+# "Unable to resolve action ... not found", before any CLA logic runs, even with
+# the org access policy set. Do not flip it private.
 #
 # AUTH: mints a token from the shared automation GitHub App (the same App
 # release-please uses), so signature commits show as the bot and there's no