chore: re-enable CLA signing for external contributors BED-7616

[superlinkx]

Description

Re-enable external contributors to sign CLA by changing back to pull_request_target

Motivation and Context

Resolves BED-7616

Now that we've had time to carefully review this action for potential exploits, we're comfortable re-enabling it. There's no other known way to make the CLA function, but the permissions and access are properly scoped and the configuration/code has been vetted.

How Has This Been Tested?

Revert of known trigger, tested prior to it being removed

Types of changes

• Chore (a change that does not modify the application functionality)

Checklist:

• I have met the contributing prerequisites
  • Assigned myself to this PR
  • Added the appropriate labels
  • Associated an issue: Issues and Pull Requests README BloodHound#672
  • Read the Contributing guide: https://github.com/SpecterOps/BloodHound/wiki/Contributing
• I have ensured that related documentation is up-to-date
  • Open API docs
  • Code comments (GoDocs / JSDocs)
• I have followed proper test practices
  • Added/updated tests to cover my changes
  • All new and existing tests passed

Summary by CodeRabbit

• Chores
  • Updated CI workflow trigger and refined conditions for pull-request comment events.
  • Adjusted workflow permissions and bumped an action to a newer version.
  • Minor formatting tweak in the workflow.

---

Note: No user-facing changes; this update affects internal development infrastructure only.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3d93dea5-236d-471c-80da-84d381584879

📥 Commits

Reviewing files that changed from the base of the PR and between d74cbdd and 1592a2b.

📒 Files selected for processing (1)

• .github/workflows/cla.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/cla.yml

---

Walkthrough

The GitHub Actions CLA workflow trigger was changed from pull_request to pull_request_target for events opened, closed, and synchronize. The CLA step condition was updated to check github.event_name == 'pull_request_target'. Action version bumped and a minor echo/whitespace tweak applied.

Changes

Cohort / File(s)	Summary
CLA Workflow Trigger /.github/workflows/cla.yml	Switched workflow trigger from pull_request → pull_request_target for issue_comment events (opened, closed, synchronize); updated step condition to github.event_name == 'pull_request_target'; bumped CLA Assistant action from v2.2.1 to v2.6.1; minor echo/formatting tweak.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐇 I hopped through YAML with nimble feet,

Swapped a trigger so the checks now meet,
Bumped a version, neat and slight,
A tiny echo, everything's right,
Hooray — CLA hops into the light.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change—re-enabling CLA signing by reverting to pull_request_target trigger, directly matching the workflow file modifications.
Description check	✅ Passed	The PR description includes all key required sections: Description, Motivation and Context with issue link (BED-7616), How Has This Been Tested, Types of changes, and a completed Checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch BED-7616

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/cla.yml:
- Line 36: The workflow conditional uses github.event_name == 'pull_request' but
the job is triggered by pull_request_target, so update the condition in the CLA
check to match the trigger (e.g., change the comparison from 'pull_request' to
'pull_request_target' or otherwise check both names) so the IF expression that
currently contains "github.event_name == 'pull_request'" will evaluate true for
PR events; locate the condition string shown in the diff and modify it
accordingly.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 652f3d4a-50a6-40d5-aaa0-f1031b2c308d

📥 Commits

Reviewing files that changed from the base of the PR and between 2bd0237 and f9e9081.

📒 Files selected for processing (1)

• .github/workflows/cla.yml

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/cla.yml (1)

37-37: Update CLA Assistant action to the latest version v2.6.1.

The workflow uses contributor-assistant/github-action@v2.2.1, which is several releases behind the latest version (v2.6.1 from September 2024). Update to include recent bug fixes and improvements.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/cla.yml at line 37, Update the GitHub Actions step that
references the contributor assistant action by changing the version tag from
contributor-assistant/github-action@v2.2.1 to
contributor-assistant/github-action@v2.6.1; locate the workflow step that uses
contributor-assistant/github-action and replace the version substring to ensure
the action runs the latest v2.6.1 release.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/cla.yml:
- Line 37: Update the GitHub Actions step that references the contributor
assistant action by changing the version tag from
contributor-assistant/github-action@v2.2.1 to
contributor-assistant/github-action@v2.6.1; locate the workflow step that uses
contributor-assistant/github-action and replace the version substring to ensure
the action runs the latest v2.6.1 release.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 03a0e90d-362e-4fb2-825c-97f243e57b2c

📥 Commits

Reviewing files that changed from the base of the PR and between f9e9081 and d74cbdd.

📒 Files selected for processing (1)

• .github/workflows/cla.yml