chore(cla): Contributor License Agreement, CLA gate, and layered licensing

.coderabbit.yaml

@@ -17,9 +17,17 @@ reviews:
   poem: false
   review_status: true
   auto_review:
-    enabled: true
+    # Gated on the CLA: auto-review is OFF by default, and a positive label match
+    # turns it on. The CLA workflow (.github/workflows/cla.yml) adds the
+    # `cla-signed` label once every commit author has signed the CLA (and removes
+    # it if an unsigned commit is pushed), so CodeRabbit only reviews after the
+    # CLA is satisfied — first sign, then review. (Per CodeRabbit: when `enabled`
+    # is false, a positive label match still triggers a review.)
+    enabled: false
     drafts: false
-    # The base branches CodeRabbit auto-reviews (regex). This is the key setting.
+    labels:
+      - cla-signed
+    # The base branches CodeRabbit auto-reviews (regex).
     base_branches:
       - develop
       - main

.github/PULL_REQUEST_TEMPLATE.md

@@ -18,6 +18,7 @@ Closes #
 - [ ] Tested as Operator / Supervisor / Admin role (if UI change)
 
 ## Checklist
+- [ ] I have signed the CLA (or this change is trivial: ≤20 lines, no new logic) — see [CLA.md](../CLA.md)
 - [ ] No `.env` secrets committed
 - [ ] Migration added if schema changed
 - [ ] `$fillable` updated if new model columns added

.github/workflows/cla.yml

@@ -0,0 +1,96 @@
+name: CLA Assistant
+
+# Gates every pull request on the Contributor License Agreement (CLA.md).
+# A contributor who has not signed is asked to comment the sign phrase once;
+# their signature is recorded in the private Mes-Open/cla-signatures repo and the
+# check turns green. The owner's accounts, org members and bots are allow-listed
+# and never asked. See docs/cla/SETUP.md for the one-time setup (PAT + repo).
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, synchronize, closed]
+
+permissions:
+  actions: write
+  contents: write
+  issues: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  cla:
+    runs-on: ubuntu-latest
+    steps:
+      - name: CLA Assistant
+        id: cla
+        # continue-on-error so the label steps below can run even when the CLA is
+        # not yet satisfied; the final step re-fails the job to keep the required
+        # "CLA Assistant" check red until everyone has signed.
+        continue-on-error: true
+        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
+        # Pinned to the exact commit of v2.6.1 (the action's repo is archived;
+        # pinning to a SHA removes the moving-tag supply-chain risk).
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Fine-grained PAT with contents:write on Mes-Open/cla-signatures.
+          PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_SIGNATURES_PAT }}
+        with:
+          path-to-signatures: 'signatures/version1/cla.json'
+          path-to-document: 'https://github.com/Mes-Open/OpenMes/blob/main/CLA.md'
+          branch: 'main'
+          remote-organization-name: 'Mes-Open'
+          remote-repository-name: 'cla-signatures'
+          # Only the owner's own accounts and bots are exempt. Org members
+          # (Svannte / Mateusz Łuczyński, JanKolo04 / Jan Kołodziej, ElNinio978)
+          # are intentionally NOT allow-listed — they sign via the bot too; their
+          # ICLA then operates on behalf of and with the company's consent (CLA §C4).
+          allowlist: 'jakub-przepiora,jakubprzepiora-cyber,dependabot[bot],github-actions[bot],renovate[bot]'
+          create-file-commit-message: 'chore: create CLA signatures file'
+          signed-commit-message: 'chore: $contributorName has signed the CLA in $owner/$repo#$pullRequestNo'
+          custom-notsigned-prcomment: |
+            Thank you for your pull request to OpenMES! / Dziękujemy za pull request do OpenMES!
+
+            Before we can merge it, please sign our Contributor License Agreement — read it in
+            [CLA.md](https://github.com/Mes-Open/OpenMes/blob/main/CLA.md). You keep the copyright to your
+            work; the CLA only grants the project the rights needed to keep OpenMES open source **and** offer
+            it under additional (commercial) licenses.
+
+            Zanim scalimy PR, prosimy o podpisanie CLA (treść w [CLA.md](https://github.com/Mes-Open/OpenMes/blob/main/CLA.md)).
+            Zachowujesz prawa autorskie do swojego kodu.
+
+            To sign, post a comment with exactly the following text / Aby podpisać, wklej komentarz o treści:
+          custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA'
+          custom-allsigned-prcomment: 'All contributors have signed the CLA. Thank you! / Wszyscy autorzy podpisali CLA. Dziękujemy!'
+          lock-pullrequest-aftermerge: false
+
+      # Gate CodeRabbit on the CLA: add the `cla-signed` label once the CLA step
+      # passed (all authors signed / allow-listed), remove it otherwise. CodeRabbit
+      # (.coderabbit.yaml) only auto-reviews PRs carrying this label — so review
+      # happens only after signing. This is a convenience gate; the hard merge
+      # block is the required "CLA Assistant" status check below.
+      - name: Sync cla-signed label
+        if: always() && (steps.cla.outcome == 'success' || steps.cla.outcome == 'failure')
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const pr = context.payload.pull_request ?? context.payload.issue;
+            // Only act on PRs (an issue_comment on a plain issue has no pull_request).
+            if (!pr || (context.payload.issue && !context.payload.issue.pull_request)) return;
+            const label = 'cla-signed';
+            const params = { owner: context.repo.owner, repo: context.repo.repo, issue_number: pr.number };
+            if ('${{ steps.cla.outcome }}' === 'success') {
+              await github.rest.issues.addLabels({ ...params, labels: [label] });
+            } else {
+              try {
+                await github.rest.issues.removeLabel({ ...params, name: label });
+              } catch (e) {
+                if (e.status !== 404) throw e; // label wasn't set — fine
+              }
+            }
+
+      # Preserve the red required check when the CLA is not yet satisfied.
+      - name: Propagate CLA status
+        if: always() && steps.cla.outcome == 'failure'
+        run: exit 1

.gitignore

@@ -119,3 +119,10 @@ magika/
 
 # E2E local specs (not upstream)
 tests/e2e/car-production-buildout.spec.ts
+
+# CLA working files — contain contributor emails (PII), keep out of the repo.
+# Ignore the specific working docs only (NOT the whole docs/cla/ dir, so the
+# tracked CLA docs — CCLA-template.md, SETUP.md — stay versioned).
+docs/cla/contributors-audit.md
+docs/cla/ai-commits.md
+docs/cla/license-scan.md