Add support for skipping CLA requirement for bots

[lukaszgryglicki]

This PR implements feature requested in #4701.

cc @mlehotskylf @thakurveerendras @amolsontakke3576 @ahmedomosanya @jarias-lfx @dealako

[Copilot]

Pull Request Overview

This PR implements support for skipping CLA requirements for bots through a configurable whitelist system. The feature allows GitHub organizations to define patterns for bot users that should automatically pass CLA checks without needing to sign CLAs.

• Adds configurable bot whitelisting via skip_cla field in GitHub organization records
• Implements pattern matching for repository names, GitHub usernames, emails, and names with support for exact matches, wildcards, and regex patterns
• Integrates the whitelisting logic into both Python and Go backend CLA validation workflows

Reviewed Changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
utils/skip_cla_entry.sh	Utility script for managing skip_cla entries in DynamoDB
utils/list_tables.sh	New utility to list DynamoDB tables with filtering
utils/describe_table.sh	Enhanced table description utility with region support
utils/describe_all.sh	New utility to describe all tables and export data
cla-backend/cla/models/github_models.py	Core Python implementation of bot whitelisting logic
cla-backend/cla/models/event_types.py	Added BypassCLA event type
cla-backend/cla/models/dynamo_models.py	Added skip_cla field to GitHubOrg model
cla-backend-go/v2/sign/helpers.go	Integration of whitelisting in Go v2 sign service
cla-backend-go/swagger/common/github-organization.yaml	API documentation for skip_cla field
cla-backend-go/signatures/service.go	Integration of whitelisting in Go v1 signatures service
cla-backend-go/github_organizations/models.go	Added skip_cla field to Go models
cla-backend-go/github/bots.go	Core Go implementation of bot whitelisting logic
cla-backend-go/events/event_types.go	Added BypassCLA event type constant
cla-backend-go/events/event_data.go	Added BypassCLA event data structure
WHITELISTING_BOTS.md	Comprehensive documentation for the feature
README.md	Added reference to bot whitelisting documentation

[ahmedomosanya]

lgtm

[trask]

thanks! can you let us know when this has been deployed so we can try it out?

[mlehotskylf]

@trask we will do some internal testing and we are planning to release this sometime in August.

[mlehotskylf]

@trask please check this ticket for any updates: #4701

[lukaszgryglicki]

@trask its deployed but I can see from logs that this bot's login reported by GitHub is different that expected:

"message": "2025-07-31T14:22:11 DEBUG cla: Checking actor: id='None',login='None',username='(null)',email='[email protected]' for skip_cla config: ['copilot-swe-agent[bot];re:^\\\\d+\\\\+Copilot@users\\\\.noreply\\\\.github\\\\.com$;*']\n"

Like the bot data from GitHub only has email - there is no login/username and name.

I will update config and retest after our internal call.

This should be ready to go in about an hour from now.

[lukaszgryglicki]

@trask @mlehotskylf @jarias-lfx the feature is deployed and confirmed that it works in requested repos, see: open-telemetry/otel-arrow#612 (comment) and openfga/vscode-ext#382 (comment)

[trask]

awesome, thanks!