GitHub Actions: Add support for cla-assistant

[Holzhaus]

In order to not pollute the git history, I suggest to create a new mixxxdj/cla repository. The CLA signatures will be tracked there.

Unfortunately our current way of tracking CLA signatures does not include the GitHub username or the source PR. Therefore I cannot add existing users to the allowlist, but I think the additional work for contributors to re-sign the CLA is neglible. It suffices to post a comment on GitHub.

Related Zulip discussion: https://mixxx.zulipchat.com/#narrow/stream/109171-development/topic/tracking.20cla.20signage
CLA Assistant GitHub Actions README: https://github.com/cla-assistant/github-action#handling-clas-and-dcos-via-github-action-alpha

Example Screenshot:

[Holzhaus]

This is still in draft state until someone creates the mixxxdj/cla repo.

[daschuer]

I am afraid If we only have the GitHub user name of a person, it is not enough. I am not a lawyer, but I think we need at least the real name of a contributor and a contact email address to have something that suits a law suit.

We have and will have the email address as part of the commit message and with it, we have also the knowledge to track existent permissions down to the first commit if necessary.

The issue with that is that some users do not like to see their real name in public ..
mmm.. no Idea how to ship around it.

[daschuer]

The original issue is that we need a hint if one is as first time contributor.

"email cannot be found in history"

Maybe we should implement that first?

The next step might be a bot linking to the existing form ....

[Holzhaus]

I am afraid If we only have the GitHub user name of a person, it is not enough. I am not a lawyer, but I think we need at least the real name of a contributor and a contact email address to have something that suits a law suit.

Neither am I, but I think it suffices. a) That CLA bot is developed by SAP and they can do something well, then it's ass-covering. So I assume it's okay, Right now we don't even have proof that someone signed the CLA himself/herself. I could put any name into that form. The CLA assistant would also track the PR it came from.

[daschuer]

At least we need to track something else than the GitHub user name.
The copyright of a contributor should not be dependent on a third party org. We may move to something else or the user may delete it's account.

[Holzhaus]

OK, I posted a feature request: contributor-assistant/github-action#58

[daschuer]

Did you consider to hand craft the poor man's solution?
Take the Email from the top-most commit, and check if it appears in the main history.
If not post the link to our Google form.

I have no idea how hard it is, but that "just" automises our current approach.
The extra benefit is that it will dicover if one uses two Email addresses.

[github-actions]

This PR is marked as stale because it has been open 90 days with no activity.