Try an alternative way for commiting updated license report

[laurit]

The problem with the current approach is that the commit isn't signed which makes the PR unmergeable because we have a rule that allows only signed commits. Instead of committing the changes manually this PR uses https://github.com/IAreKyleW00t/verified-bot-commit that goes through github api and should produce a verified commit from github-actions[bot]. Didn't test.

[Copilot]

🟡 Changes recommended

The updated license-report check can trigger unnecessary commits (timestamp-only diffs) and should be aligned with the existing license-check logic before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the Renovate license-report auto-fix workflow to create “verified” bot commits (to satisfy the repository’s signed/verified commit requirement), and adjusts the CLA workflow allowlist to accommodate commits authored by github-actions[bot].

Changes:

• Replace manual git commit && git push with IAreKyleW00t/verified-bot-commit for committing regenerated license reports.
• Re-run the PR workflow only when a license-report commit was actually created.
• Add github-actions[bot] to the CLA Assistant allowlist.

File summaries

File	Description
.github/workflows/pr.yaml	Switches license-report auto-commit to a verified bot commit action and conditions the workflow re-run on an actual commit.
.github/workflows/cla.yml	Allows CLA checks to pass when commits are authored by github-actions[bot].

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The commit targets the wrong ref, and the follow-up workflow is never dispatched.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/pr.yaml:321

• verified-bot-commit does not define a committed output; its success output is named commit. This expression therefore resolves to an empty value even after a commit, so the follow-up workflow is never dispatched and the failed license check is not rerun against the generated report.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The invalid output condition prevents required checks from running on the bot commit.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/pr.yaml:322

• This condition can never pass: verified-bot-commit v2.3.5 exposes blobs, tree, commit, and ref, but no committed output. As a result, the required manually dispatched PR workflow never runs after the bot commit, leaving the new commit without its checks. Test the documented commit output instead.

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

The commit operation must reject concurrent branch updates to avoid publishing stale license reports.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[breedx-splk]

Thanks. This looks like a viable approach! I don't love the additional action dependency, but let's try it out.