From e09d896fdf490011cdca8776e2d4b0bb0e1868df Mon Sep 17 00:00:00 2001 From: Sid Mohan <61345237+sidmohan0@users.noreply.github.com> Date: Tue, 14 Jul 2026 12:19:48 -0700 Subject: [PATCH] docs: add CLA policy pilot --- .github/PULL_REQUEST_TEMPLATE.md | 5 + .gitignore | 2 + CLA.md | 181 +++++++++++++++++++++++++++++++ CONTRIBUTING.md | 13 +++ docs/cla-administration.md | 84 ++++++++++++++ docs/cla-policy.md | 74 +++++++++++++ 6 files changed, 359 insertions(+) create mode 100644 CLA.md create mode 100644 docs/cla-administration.md create mode 100644 docs/cla-policy.md diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index c3a6b2d3..1bf1839b 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -32,6 +32,11 @@ Optional profiles tested: - [ ] ocr - [ ] distributed +## Contributor License + +- [ ] The `license/cla` check passes, or DataFog has documented an exemption for + every contributor to this pull request. + ## Notes For Reviewers Mention API changes, migrations, warnings, or release-note needs. diff --git a/.gitignore b/.gitignore index cf11a42c..d09383be 100644 --- a/.gitignore +++ b/.gitignore @@ -60,6 +60,8 @@ docs/* !docs/Makefile !docs/make.bat !docs/optional-surfaces.rst +!docs/cla-policy.md +!docs/cla-administration.md !docs/agents/ !docs/agents/** !docs/audit/ diff --git a/CLA.md b/CLA.md new file mode 100644 index 00000000..f87687aa --- /dev/null +++ b/CLA.md @@ -0,0 +1,181 @@ +# DataFog Individual Contributor License Agreement + +Version 1.0 + +Thank you for your interest in contributing to open-source projects managed by +DataFog, Inc. ("DataFog," "we," "us," or "our"). + +This Individual Contributor License Agreement (the "Agreement") documents the +rights granted by individual contributors to DataFog. It is a legally binding +agreement, so please read it carefully before accepting it. + +This Agreement covers contributions to public software, documentation, and +other open-source projects owned or managed by DataFog, including projects in +the [`DataFog` GitHub organization](https://github.com/DataFog) that reference +this Agreement (collectively, the "Projects"). You need to accept this Agreement +only once unless DataFog publishes a new version and asks you to accept it. + +To accept this Agreement, follow the electronic signing instructions presented +by DataFog's CLA service. The signing record will be associated with your +authenticated GitHub account. + +If an employer or another entity owns or controls the rights in your +Contribution, do not accept this individual Agreement on that entity's behalf +unless you have authority to do so. Contact +[`legal@datafog.ai`](mailto:legal@datafog.ai) for the entity contribution +process. + +## 1. Definitions + +"You" means the individual who Submits a Contribution to us. + +"Contribution" means any work of authorship that is Submitted by You to us in +which You own or assert ownership of the Copyright. + +"Copyright" means all rights protecting works of authorship owned or controlled +by You, including copyright, moral, and neighboring rights, as appropriate, for +the full term of their existence, including any extensions controlled by You. + +"Material" means the software, documentation, or other work that we make +available to third parties as part of a Project. After You Submit a +Contribution, it may be included in the Material. + +"Submit" means any form of electronic, verbal, or written communication sent to +us or our representatives for the purpose of discussing or improving a Project, +including communications through source-code control systems and issue trackers +managed by or on behalf of us. Communications conspicuously marked or otherwise +designated in writing as "Not a Contribution" are excluded. + +"Submission Date" means the date on which You Submit a Contribution to us. + +"Effective Date" means the date You electronically accept this Agreement or the +date You first Submit a Contribution to us, whichever is earlier. + +"Media" means any portion of a Contribution that is not software. + +## 2. Grant of Rights + +### 2.1 Copyright License + +You retain ownership of the Copyright in Your Contribution and have the same +rights to use or license the Contribution that You would have had without +entering into this Agreement. + +To the maximum extent permitted by applicable law, You grant to us a perpetual, +worldwide, non-exclusive, transferable, royalty-free, irrevocable license under +the Copyright covering the Contribution, with the right to sublicense those +rights through multiple tiers of sublicensees, to reproduce, prepare derivative +works of, modify, display, perform, and distribute the Contribution as part of +the Material, subject to Section 2.3. + +### 2.2 Patent License + +For patent claims, including method, process, and apparatus claims, that You +own, control, or have the right to grant now or in the future, You grant to us a +perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable +patent license, with the right to sublicense through multiple tiers of +sublicensees, to make, have made, use, sell, offer for sale, import, and +otherwise transfer the Contribution and the Contribution in combination with +the Material or portions of that combination. This license applies only to the +extent that exercising the licensed rights infringes those patent claims and is +subject to Section 2.3. + +### 2.3 Outbound Licensing + +If we include Your Contribution in Material, we may license the Contribution +under any license, including copyleft, permissive, commercial, or proprietary +licenses. As a condition of exercising this right, we also agree to license the +Contribution under the license or licenses that we were using for the Material +on the Submission Date. + +We may license Media in a Contribution under the license used for the relevant +Project, a Creative Commons license, or another license that permits use of the +Media with the Project. + +### 2.4 Moral Rights + +If moral rights apply to the Contribution, to the maximum extent permitted by +law, You waive and agree not to assert those rights against us, our successors +in interest, or our direct or indirect licensees. + +### 2.5 Our Rights + +You acknowledge that we are not obligated to use Your Contribution and may +decide whether to include it in a Project. + +### 2.6 Reservation of Rights + +You reserve all rights not expressly licensed under this Section 2. + +## 3. Your Representations + +You confirm that: + +1. You have the legal authority to enter into this Agreement. +2. You own, or have sufficient authority to license, the Copyright and patent + claims covering the Contribution as required to grant the rights in Section 2. +3. The grant of rights in Section 2 does not violate rights You have granted to + third parties, including Your employer. If Your employer or another entity + may own rights in Your Contribution, You have obtained permission to make the + Contribution or that entity has completed DataFog's entity contribution + process. +4. Each Contribution is Your original creation, except for third-party material + that You clearly identify along with its source and applicable license or + other restrictions. +5. You will notify us of any facts or circumstances You become aware of that + would make these representations inaccurate. +6. If You are under eighteen years old, You will contact DataFog before + accepting this Agreement and will follow any guardian-approval process + required by DataFog. + +## 4. Disclaimer + +EXCEPT FOR THE EXPRESS REPRESENTATIONS IN SECTION 3, THE CONTRIBUTION IS +PROVIDED "AS IS." TO THE MAXIMUM EXTENT PERMITTED BY LAW, YOU DISCLAIM ALL +EXPRESS OR IMPLIED WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. TO THE EXTENT A WARRANTY +CANNOT BE DISCLAIMED, IT IS LIMITED TO THE MINIMUM DURATION PERMITTED BY LAW. + +## 5. Consequential Damage Waiver + +TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, YOU WILL NOT BE LIABLE FOR +LOST PROFITS, LOST ANTICIPATED SAVINGS, LOST DATA, OR INDIRECT, SPECIAL, +INCIDENTAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES ARISING OUT OF THIS AGREEMENT, +REGARDLESS OF THE LEGAL OR EQUITABLE THEORY ON WHICH THE CLAIM IS BASED. + +## 6. Miscellaneous + +1. This Agreement is governed by the laws of the State of Delaware, excluding + its conflict-of-law provisions. The United Nations Convention on Contracts + for the International Sale of Goods does not apply. +2. This Agreement is the entire agreement between You and us concerning Your + Contributions and supersedes prior agreements or understandings concerning + those Contributions. +3. If You or we assign rights or obligations under this Agreement to a third + party, that third party must agree in writing to abide by this Agreement. +4. A failure by either party to require performance of a provision in one + situation does not waive the right to require performance later. +5. If a provision is found void or unenforceable, it will be replaced to the + extent possible by an enforceable provision closest to its original meaning, + and the remaining provisions will continue in effect. +6. Electronic acceptance through DataFog's designated CLA service constitutes + Your signature. The electronic record identifies the Agreement version, Your + authenticated GitHub identity, and the time of acceptance. + +## Contact + +DataFog, Inc.
+1209 Orange St.
+Wilmington, DE 19801, USA
+[`legal@datafog.ai`](mailto:legal@datafog.ai) + +## Template attribution + +This Agreement is adapted from the Harmony Individual Contributor License +Agreement (HA-CLA-I), Version 1.0, with Outbound License Option Five selected. +The Harmony template is licensed under the +[Creative Commons Attribution 3.0 Unported License](https://creativecommons.org/licenses/by/3.0/). +DataFog modified the template to identify the parties and Projects, support +electronic acceptance, clarify third-party submissions and entity-owned work, +and align the governing law and contact information with DataFog's published +terms. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6e7e416e..fa0a9ad0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -121,6 +121,19 @@ By submitting a pull request, you license your contribution under the project [license](LICENSE). You also affirm that you authored the contribution or have the right to submit it under the project license. +Before an external contribution can be merged, every contributor must sign the +[DataFog Individual Contributor License Agreement](CLA.md) unless DataFog has +documented another agreement covering the contributor and contribution. You +retain copyright ownership; the CLA grants DataFog, Inc. broad, non-exclusive +copyright and patent rights, including the ability to use the contribution in +open-source, commercial, and proprietary distributions while continuing to +offer it under the project's license in effect when it was submitted. + +If an employer or another entity owns or may own your contribution, contact +[`legal@datafog.ai`](mailto:legal@datafog.ai) before signing or submitting it. +See the [CLA policy](docs/cla-policy.md) for signing, exemptions, and entity-owned +contributions. + ## Contributors Thanks to early contributors including: diff --git a/docs/cla-administration.md b/docs/cla-administration.md new file mode 100644 index 00000000..301e707a --- /dev/null +++ b/docs/cla-administration.md @@ -0,0 +1,84 @@ +# CLA Administration Runbook + +This runbook describes the rollout and ongoing administration of DataFog's +Contributor License Agreement (CLA). The legal text should be approved by +DataFog's counsel before the hosted integration is activated. + +## Service + +Use the SAP-hosted [CLA Assistant](https://cla-assistant.io/) integration. Do +not use the archived `contributor-assistant/github-action` workflow. + +CLA Assistant uses a GitHub Gist as its agreement source. The reviewed +[`CLA.md`](../CLA.md) in this repository is the source text for the initial +Gist. Treat the Gist revision and repository version as one release: any +substantive change creates a new agreement version and may require contributors +to sign again. + +## Pilot rollout + +1. Obtain legal approval for `CLA.md`, including the entity name, Delaware law, + patent grant, and Outbound License Option Five. +2. Create a public Gist owned by a durable DataFog administrative account using + the approved `CLA.md` contents. +3. Sign in to CLA Assistant with that account and link the Gist to + `DataFog/datafog-python`. +4. Configure exemptions only for verified DataFog personnel and trusted bot + accounts. At minimum, review Dependabot, Renovate, release automation, and + any account that commits generated changes. +5. Open a pull request from a non-member test account and verify that: + - CLA Assistant requests a signature; + - signing is tied to the authenticated GitHub account; + - the `license/cla` status changes from failing to passing; and + - a new commit by another author causes the pull request to be rechecked. +6. In the branch protection rule for `dev`, require the `license/cla` status + check. Apply the rule to administrators if the policy is intended to be + non-bypassable. +7. Verify bot and internal-member pull requests pass using documented + exemptions. +8. Merge the policy change only when the signing flow and required check have + both been tested. + +## Organization rollout + +DataFog currently uses GitHub Free, so organization-wide rulesets are not +available. Repeat the following for every active public repository: + +1. Confirm its license, default branch, and contribution guide. +2. Add links to the organization CLA and CLA policy. +3. Enable CLA Assistant using the same agreement version. +4. Protect the default branch and require `license/cla` before merge. +5. Test an external pull request and an exempt bot pull request. +6. Record the repository, protected branch, activation date, agreement version, + exemptions, and test pull request in the rollout inventory. + +If DataFog upgrades to GitHub Team or Enterprise, replace per-repository status +configuration with an organization ruleset targeting the default branches of +the covered public repositories. + +## Historical contributions + +Before relying on the CLA for commercial or proprietary relicensing of existing +code: + +1. inventory historical commits and pull requests by non-DataFog contributors; +2. distinguish original contributions from mechanical or third-party changes; +3. obtain the current CLA from the relevant rights holder; and +4. replace or isolate code where broader rights cannot be obtained. + +Do not assume that a newly signed workflow retroactively covers a contributor +who has not accepted the agreement. + +## Records and continuity + +- Export the signer list and agreement-version records at least quarterly and + after every agreement update. +- Store exports in access-controlled company storage, not in a public + repository. +- Keep at least two DataFog administrators able to manage the integration and + its Gist. +- Review exemptions quarterly and remove stale accounts. +- Re-run the external-contributor test after changes to the CLA integration, + branch protection, repository ownership, or default branch. +- Document any manual entity CLA or special authorization in the same + access-controlled legal record system. diff --git a/docs/cla-policy.md b/docs/cla-policy.md new file mode 100644 index 00000000..65abcf50 --- /dev/null +++ b/docs/cla-policy.md @@ -0,0 +1,74 @@ +# Contributor License Agreement Policy + +DataFog uses a Contributor License Agreement (CLA) to keep the origin and +licensing of external contributions clear across its open-source projects. + +## What contributors grant + +Contributors keep ownership of their work. By signing the +[DataFog Individual Contributor License Agreement](../CLA.md), an individual +grants DataFog, Inc. a broad, non-exclusive copyright and patent license. The +agreement allows DataFog to: + +- continue distributing the contribution under the open-source license in use + by the project when the contribution was submitted; +- use and sublicense the contribution in other open-source, commercial, or + proprietary distributions; and +- maintain, enforce, and evolve the project without seeking a new signature for + each contribution. + +The CLA does not transfer copyright ownership to DataFog. + +## Who must sign + +Every external contributor whose pull request will be merged must sign the +current CLA unless DataFog has documented another agreement covering that +contributor and the contribution. + +DataFog may exempt: + +- DataFog employees and contractors whose contributions are covered by a + written intellectual-property agreement; +- organization members whose contributions are otherwise covered in writing; + and +- trusted automation accounts that make mechanical changes and cannot sign. + +An allowlist is an administrative convenience, not a substitute for verifying +that the contributor's work is covered by an appropriate agreement. + +## Employer- or entity-owned work + +An individual should sign only if they own the contribution or have authority +to grant the rights in it. If an employer or another entity owns or may own the +work, contact [`legal@datafog.ai`](mailto:legal@datafog.ai) before the pull +request is merged. DataFog will use an entity CLA or written authorization when +appropriate. + +## How signing works + +When an external contributor opens a pull request, DataFog's CLA service posts +signing instructions and reports a `license/cla` status. The contributor signs +once with an authenticated GitHub account. A new signature may be required if +DataFog publishes a new agreement version. + +Maintainers must not merge an external pull request unless `license/cla` passes +or the contributor has a documented exemption. + +## Agreement and signature records + +The agreement is versioned. DataFog retains or exports records sufficient to +identify the signer, agreement version, signing time, and authenticated GitHub +identity. The hosted CLA service may process the signer's GitHub identity and +associated email under +[SAP's CLA Assistant privacy notice](https://gist.github.com/CLAassistant/3a73e4cd729c9d0a6e30). + +Requests concerning a signature record or the CLA should be sent to +[`legal@datafog.ai`](mailto:legal@datafog.ai). + +## Existing contributions + +The CLA workflow applies to new pull requests after activation. Existing +contributions remain governed by the licenses and agreements in effect when +they were submitted. If DataFog needs broader rights to an existing external +contribution, it must obtain those rights from the contributor or replace the +contribution.