CLA Assistant cannot record signatures: the ruleset on `main` blocks its commit

Summary

CLA Assistant can no longer record signatures. The action stores them by committing directly to main, and a repository ruleset now rejects that write, so the check stays red no matter what a contributor does. External contributors cannot self-serve past it.

Evidence

Every run fails the same way — most recently run 33604159906:

##[error]Could not update the JSON file: Repository rule violations found

Changes must be made through a pull request.

The signature file confirms it. signatures/version1/cla.json holds 6 entries, and the last successful write was 2025-08-06 (@datitran has signed the CLA in hoophq/hoop#976). Nothing has been recorded since.

The bot's state is also inconsistent as a result: it edits its PR comment to "All contributors have signed the CLA ✍️ ✅" while the check remains failure and the signature was never persisted.

Root cause

.github/workflows/cla.yml stores signatures on the protected default branch — and the file already warns against exactly this, two lines above the setting:

path-to-signatures: 'signatures/version1/cla.json'
path-to-document: 'https://github.com/hoophq/hoop/blob/main/CLA.md'
# branch should not be protected
branch: 'main'

contributor-assistant/github-action commits with GITHUB_TOKEN, which the ruleset on main blocks because it requires changes to arrive via pull request.

Impact

Any contributor not in the allowlist: is blocked. Posting the required comment triggers the workflow, the workflow fails, and the check never turns green — there is no action the contributor can take. Combined with workflow runs from first-time fork contributors sitting at action_required, an outside PR currently cannot reach a mergeable state without maintainer intervention on both fronts.

Proposed solutions

In rough order of preference:

1. Move signature storage off the protected branch. The action takes a branch: input; pointing it at an unprotected branch such as cla-signatures keeps everything in this repo and needs no ruleset change. Smallest change, matches the file's own warning.
2. Store signatures in a separate repository. The workflow already carries the commented-out remote-organization-name / remote-repository-name inputs and the PERSONAL_ACCESS_TOKEN env for this, so it is a matter of filling them in.
3. Grant the Actions bot a ruleset bypass for signatures/version1/cla.json on main. Keeps current layout, but widens what can write to the default branch.
4. Short-term unblock: add the affected contributor to allowlist: so their PR can proceed while one of the above lands.

Whichever route is taken, signatures recorded before the break are unaffected — the file itself is intact.

Reference

Hit while opening #1765. That PR is otherwise ready: the automated review reports 0 bugs / 0 rule violations / 0 conflicts, and its remaining blockers are this CLA failure, the pending workflow approval, and the required release label.

I am happy to open a PR for option 1 or 2 if a maintainer says which they prefer.