fix(cla-assistant): make the allowlist bots only, and default it here (ENG-2017)

[lucas-koontz]

User story

As whoever has to know who is exempt from signing our contributor agreement
I want that answer in one file, and to be a list of bots rather than a list of people
So that nobody has to prune six copies of a stale employee roster, and nobody forgets to

Why this matters

Fifteen repositories carried six different hand-maintained allowlists, naming 25 people between them. They are not six policies. They are six snapshots of who worked here when each repository was last touched.

11 of those 25 are no longer in the mindsdb org: George3d6, Ricram2, ala12326571, dusvyat, dylanketterer, ilia-tsyplenkov, maximlopin, mindsdbadmin, paxcema, tmichaeldb, tomhuds. An allowlist entry exempts that account from signing, so each is a former colleague who can contribute to GPL-3.0 and Elastic-2.0 code without signing anything.

A list of people is an access-control list. It needs an owner and a review, and nobody was ever going to give six copies either.

What changes

Staff sign like everybody else. It is one comment, it produces an actual signed record rather than an assumption that somebody's employment agreement was in place and covered the work, and it deletes the stale-list problem instead of managing it.

Bots stay, and that is not a shortcut. A bot cannot post the agreement sentence, so with no exemption its pull request is red forever. Measured across all fifteen repositories, exactly two bots open pull requests here:

42  dependabot[bot]
13  mindsdb-release-train[bot]

lightwood alone has 36 Dependabot pull requests in its last 100. github-actions[bot] needs no entry, because the action already drops user id 41898282 in graphql.ts before the allowlist is consulted.

The list lives here and defaults. A wrapper now passes path-to-document and nothing else.

Two live defects this removes

Both come out of checkAllowList.ts, and both were in all fifteen repositories.

bot* was never a prefix match. The action compiles it to new RegExp("bot.*") and calls .test(), which is unanchored and searches anywhere in the string. So it also exempted any login containing "bot". I ran the action's own matcher:

login	exempt?
dependabot[bot]	yes, intended
robotnik	yes
sabotage	yes
elliotbotson	yes

That is an opt-out anybody could grant themselves by choosing a username. Naming the two bots removes the wildcard and the hole with it.

Stpmax never matched StpMax. Non-wildcard entries are compared with pattern === committer, exact and case-sensitive. Every one of the six lists writes Stpmax; the real login is StpMax. He has been exempt in zero repositories and asked to sign every time. Dropping the human entries makes the whole class unreachable.

Acceptance criteria

• The reusable's allowlist input defaults, so a caller can omit it.
• The default contains no *, so no lookalike login is exempt.
• The default contains no human logins.
• dependabot[bot] and mindsdb-release-train[bot] stay exempt, so bot pull requests do not go permanently red.
• CI fails if any of the above stops being true.
• Negative: a caller that still passes allowlist keeps working. Making a required input optional is backward compatible, which is what lets the thirteen wrappers drop it in any order after this merges.

How to test

1. Merge this, then open a pull request on a converted repository from an account that is not a bot. Confirm the CLA bot asks for a signature, including for staff.
2. Confirm a Dependabot pull request on lightwood still passes the CLA check with no comment.
3. Run uv run --with pyyaml --with pytest --python 3.12 -m pytest tests/test_cla_allowlist.py -q. Then put bot*, ZoranPandovski back as the default and run it again; it should go red.

Notes for the reviewer

Everyone at MindsDB will be asked to sign, once per repository, the first time they open a pull request there. That is the intended cost and it is worth saying out loud before this merges, because it will surprise people. Fourteen current org members are affected. It is one comment each.

The mindsdbadmin question is left open on purpose. It is in every one of the six lists, it is not an org member, and engine's and minds_python_sdk's release jobs still guard on github.actor != 'mindsdbadmin', so something still uses it. Whether it needs an exemption is a question for whoever owns that account, not something to guess at here.

Ex-staff lose their exemption, and I think that is correct rather than a regression. All eleven are already out of the org. If they contribute again they sign, like any other outside contributor. Say if you would rather grandfather any of them, because it is one entry.

The test is a real guard, not coverage theatre. Against the old list it fails 8 of its 11 cases, including all four lookalike logins.

Verified locally

Check	What I observed
pytest tests/ -q	148 passed in 0.33s. 137 before, 11 new.
The guard actually bites	Replaced the default with bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin and re-ran: 8 failed, 3 passed. Restored: 11 passed.
actionlint	Clean across all 12 workflows, v1.7.12.
workflow_graph.py --allow-external-reusables	"Checked 12 workflow(s): every local reusable call composes, and every event produces exactly one run tree."
Which bots actually open pull requests	gh api repos/mindsdb/<repo>/pulls?state=all&per_page=100 across all 15: dependabot[bot] 42, mindsdb-release-train[bot] 13, nothing else.
github-actions[bot] is filtered upstream	graphql.ts drops id 41898282; gh api user/41898282 resolves to github-actions[bot].
Who is still in the org	gh api orgs/mindsdb/members/<login> for all 25 named logins: 14 members, 11 not.

Ships with

The thirteen wrappers that currently pass their own list drop it, in any order
after this merges. Making a required input optional is backward compatible, so
nothing breaks in the window between.

Merge order: this one first. A wrapper that drops allowlist while the
input is still required: true fails to load.

Refs: ENG-2017