fix: extract CLA label job into dedicated workflow to prevent feedback loop

.changeset/fix-cla-workflow-loop.md

@@ -0,0 +1,11 @@
+---
+"@googleworkspace/cli": patch
+---
+
+fix: extract CLA label job into dedicated workflow to prevent feedback loop
+
+The Automation workflow's `check_run: [completed]` trigger caused a feedback
+loop — every workflow completion fired a check_run event, re-triggering
+Automation, which produced another check_run event, and so on. Moving the
+CLA label job to its own `cla.yml` workflow eliminates the trigger from
+Automation entirely.

.github/workflows/automation.yml

@@ -21,12 +21,6 @@ on:
     types: [opened, synchronize, reopened]
   pull_request_review:
     types: [submitted]
-  check_run:
-    types: [completed]
-
-concurrency:
-  group: automation-${{ github.event_name }}-${{ github.event.check_run.name || github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
 
 permissions:
   contents: write
@@ -57,45 +51,6 @@ jobs:
           git add -A
           git diff --cached --quiet || git commit -m "style: cargo fmt" && git push
 
-  cla-label:
-    name: CLA Label
-    if: >-
-      github.event_name == 'check_run' &&
-      github.event.check_run.name == 'cla/google'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Update CLA label
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GOOGLEWORKSPACE_BOT_TOKEN }}
-          script: |
-            const cr = context.payload.check_run;
-            const passed = cr.conclusion === 'success';
-
-            for (const pr of cr.pull_requests) {
-              const labels = passed
-                ? { add: 'cla: yes', remove: 'cla: no' }
-                : { add: 'cla: no', remove: 'cla: yes' };
-
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pr.number,
-                labels: [labels.add],
-              });
-
-              try {
-                await github.rest.issues.removeLabel({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: pr.number,
-                  name: labels.remove,
-                });
-              } catch (e) {
-                // Label not present — ignore
-              }
-            }
-
   file-labeler:
     name: File Labeler
     if: github.event_name == 'pull_request_target'

.github/workflows/cla.yml

@@ -0,0 +1,60 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: CLA
+
+on:
+  check_run:
+    types: [completed]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  cla-label:
+    name: CLA Label
+    if: github.event.check_run.name == 'cla/google'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Update CLA label
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GOOGLEWORKSPACE_BOT_TOKEN }}
+          script: |
+            const cr = context.payload.check_run;
+            const passed = cr.conclusion === 'success';
+
+            for (const pr of cr.pull_requests) {
+              const labels = passed
+                ? { add: 'cla: yes', remove: 'cla: no' }
+                : { add: 'cla: no', remove: 'cla: yes' };
+
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+                labels: [labels.add],
+              });
+
+              try {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: pr.number,
+                  name: labels.remove,
+                });
+              } catch (e) {
+                // Label not present — ignore
+              }
+            }