[thepwagner]

Summary

Call Shopify/shopify-cla-action directly from Hansel's CLA workflow, following the pattern used by EJSON, Krane, and other Shopify repositories.

This removes Hansel's dependency on Shopify/github-workflows as a small preparatory step toward archiving that repository. It does not archive or otherwise change that repository.

Behavior

Inline the job from the currently pinned reusable workflow (0b6f7f7def1c8f895fd31cd4183f98e3562458e9, v0.2.0), retaining:

• the same action SHA (9938f4b43524d1cfa7471ce9a803edf226697284, v1.8.0), rather than also changing the action version;
• PR and issue-comment triggers and the existing event filter;
• explicit actions: write and pull-requests: write permissions;
• the same GITHUB_TOKEN and CLA_TOKEN secrets;
• no checkout or execution of pull-request code.

The check name changes from the nested reusable-job name (cla / cla) to cla. GitHub's effective branch-rules endpoint returned no required-status-check rule for main; the legacy protection endpoint returned 404. If a required check is configured elsewhere, update its name when landing.

Validation

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/cla.yml
• git diff --check
• Compared the inlined job against the exact reusable-workflow revision Hansel currently calls.

Because this workflow uses pull_request_target, the PR's own CLA run executes the base-branch workflow, not this modified version. Live validation of the new workflow requires a subsequent PR/comment event after merge.