readme cla

.github/workflows/cla.yaml

@@ -20,10 +20,10 @@ jobs:
   cla:
     runs-on: ubuntu-latest
     if: |
-      (github.event.issue.pull_request 
+      (github.event.issue.pull_request
         && !github.event.issue.pull_request.merged_at
         && contains(github.event.comment.body, 'signed')
-      ) 
+      )
       || (github.event.pull_request && !github.event.pull_request.merged)
     permissions:
       pull-requests: write

.github/workflows/scorecard-self.yaml

@@ -2,7 +2,7 @@ name: Scorecard (self)
 on:
   branch_protection_rule:
   schedule:
-    - cron: '30 1 * * 6'
+    - cron: "30 1 * * 6"
   workflow_dispatch:
 
 permissions: {}

README.md

@@ -15,16 +15,47 @@ Create/modify the `.github/dependabot.yaml` file in your repository. Make sure t
 ```yaml
 version: 2
 updates:
-- package-ecosystem: github-actions
-  directory: /
-  schedule:
-    interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
 ```
-  
+
 </details>
 
 ## Available workflows
 
+### cla.yaml
+
+Ensure any code contributors have signed the [Shopify CLA](https://cla.shopify.com).
+
+<details>
+<summary>Example Workflow</summary>
+
+```yaml
+name: Contributor License Agreement (CLA)
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+  issue_comment:
+    types: [created]
+
+permissions: {}
+
+jobs:
+  cla:
+    uses: Shopify/github-workflows/.github/workflows/cla.yaml@c142f2dd84228c90bd716e4b5eafc68bd812f467 # v0.0.3
+    permissions:
+      pull-requests: write
+    secrets:
+      token: ${{secrets.GITHUB_TOKEN}}
+      cla-token: ${{secrets.CLA_TOKEN}}
+```
+
+</details>
+
+
 ### scorecard.yaml
 
 Publish an [OpenSSF Scorecard](https://securityscorecards.dev/) for a project.
@@ -34,23 +65,24 @@ Consider adding a badge like `https://api.securityscorecards.dev/projects/github
 
 <details>
 <summary>Example Workflow</summary>
-  
+
 ```yaml
 name: Scorecard
 on:
   branch_protection_rule:
   schedule:
-    - cron: '30 1 * * 6'
+    - cron: "30 1 * * 6"
 
 permissions: {}
 
 jobs:
-  build:
+  analysis:
     permissions:
       contents: read
       id-token: write
     uses: Shopify/github-workflows/.github/workflows/scorecard.yaml@0cd53e568340d24a2aefc65236f0973b47402c14 # v0.0.1
     secrets:
       token: ${{secrets.GITHUB_TOKEN}}
 ```
+
 </details>