Migrating to the new OpenJS Foundation CLA bot

[brianwarner]

Hi, I'm with the OpenJS Foundation and we are migrating projects that use the old JSF CLA bot over to the new OpenJS CLA using EasyCLA. If you're a regular contributor you'll want to keep reading for some tips on handling the transition. The JSF CLA bot is no longer working and so we are doing this migration over the next few days. If you've already signed the OpenJS Foundation CLA using EasyCLA, you will see no impact. One signature is all that's required across all OpenJS Foundation projects.

First, some brief background. A few years ago the JS Foundation merged with Node.js Foundation to form the OpenJS Foundation. The JS Foundation required a CLA, and operated a bot to enforce signatures. The OpenJS Foundation no longer requires projects to use a CLA; it is left to each project's maintainers to decide whether to use the DCO (at minimum) or the OpenJS Foundation CLA.

For projects that continue using a CLA, two big things changed. First, we're using a different tool called EasyCLA. It is developed and managed by the Linux Foundation (including the underlying infrastructure). CLAs can be signed either by individuals acting on their own behalf, or signed by companies on behalf of their employees. Also, because we're working from a centralized CLA infrastructure, contributors who sign the OpenJS Foundation CLA once are covered for any other OpenJS Foundation projects.

Second, we've changed the text of the CLA. The JSF CLA was essentially a bespoke wrapper around the text of the DCO, which meant contributors (and their legal counsel) would have to evaluate something completely new. In keeping with the Principle of Least Astonishment, we've changed to the much more common Apache-style CLA templates. If you need your company to sign your CLA, there's now a much better chance your counsel will recognize what they're seeing.

Because the organization and the CLA text have both changed, we can't continue to use the old signatures. Subsequent contributions will require you to sign the new document. To be clear, this only applies to new contributions; prior contributors do not need to go back and re-sign the document unless they make a new contribution.

So what do you need to do? You can always just wait until the bot is enabled and sign the doc when you open your first PR. If you aren't already in the system, it'll leave a comment on your PR with a link to follow. If you want to make things easier, or if you're a high-volume contributor and want to get it out of the way early, you can pre-sign the OpenJS Foundation CLA by opening a trivial PR against this repo (we periodically close open PRs).

If you have any questions, please ask!