From 77cd9c72649fdea7854c8a1525e2e46b2729c8f8 Mon Sep 17 00:00:00 2001
From: jan-kubica <jankubica@protonmail.com>
Date: Sun, 18 Oct 2026 09:52:49 +0200
Subject: [PATCH] chore(ci): use shared CLA verification

---
 .github/workflows/cla.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/cla.yml

diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
new file mode 100644
index 0000000..e67bd16
--- /dev/null
+++ b/.github/workflows/cla.yml
@@ -0,0 +1,33 @@
+name: CLA Assistant
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target: # zizmor: ignore[dangerous-triggers] delegates to pinned reusable CLA workflow; never check out PR code here
+    types: [opened, synchronize, reopened, closed]
+
+permissions:
+  actions: write
+  contents: read
+  issues: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  cla:
+    if: >-
+      (
+        github.event_name == 'pull_request_target'
+      ) || (
+        github.event_name == 'issue_comment'
+        && github.event.issue.pull_request
+        && (
+          github.event.comment.body == 'recheck'
+          || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'
+        )
+      )
+    uses: stella/.github/.github/workflows/cla.yml@8f19eb7220047e5b06f6e75f0b9f908bfd01f5f6
+    with:
+      allowlist: dependabot[bot],renovate[bot],github-actions[bot],stella-provenance-updater[bot]
+    secrets:
+      CLA_APP_PRIVATE_KEY: ${{ secrets.CLA_APP_PRIVATE_KEY }}