bug: contrib CLA workflow permanently locks PRs on close, breaking the cla check

从 .github/workflows/contrib.yaml 中的 cla 作业和事件触发器开始，然后将已关闭和重新打开的 pull request 的 workflow 行为与 contributor-assistant action 的设置进行比较。当关闭并重新打开 pull request 不再在 CLA 评论更新之前将其锁定，并且 cla 检查能够正常通过时，修复就完成了。

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The cla job in .github/workflows/contrib.yaml runs contributor-assistant/github-action with the default lock-pullrequest-aftermerge: true. The action locks the pull request on the closed event, regardless of whether the PR was merged or just closed.

Because contrib.yaml also triggers on reopened, closing and reopening a PR puts it into a state the contributor cannot escape:

1. closed fires. The action locks the PR. Job succeeds.
2. reopened fires. The action tries to create or update its CLA comment. The PR is now locked, so the write fails and the job errors out.

From that point on the cla check fails on every subsequent run, because the action always needs to write a comment and the lock is never lifted. The failure is unrelated to whether the CLA is actually signed. Only a repository admin can unlock, so the PR author cannot recover.

This also blocks the documented recheck escape hatch, since the lock prevents the contributor from commenting at all.

Relevant Log Output

# Run 30312572901, triggered by `closed` at 22:58:17Z, conclusion: success
CLA Assistant GitHub Action bot has started the process
Locking the Pull Request to safe guard the Pull Request CLA Signatures
successfully locked the pull request 27499

# Run 30312578189, triggered by `reopened` at 22:58:33Z, conclusion: failure
CLA Assistant GitHub Action bot has started the process
##[error]Could not update the JSON file: Error occured when creating or editing
the comments of the pull request: Error occured when updating the pull request
comment: Unable to create comment because issue is locked.

Expected Behavior

Closing and reopening a pull request should not permanently break the cla check.

A few options:

• Set lock-pullrequest-aftermerge: false, since the job runs on closed and cannot distinguish merged from closed.
• Gate the cla job so it does not run on the closed action.
• Unlock the PR when the reopened action fires.

Steps to Reproduce

1. Open a pull request as an external contributor who has not yet signed the CLA.
2. Sign the CLA. The signature is recorded in coder/cla.
3. Close the pull request, then reopen it to force a re-run of the check.
4. The closed run locks the PR. The reopened run fails with Unable to create comment because issue is locked.
5. The cla check now fails permanently and the contributor cannot unlock or comment.

Environment

• Host OS: n/a (GitHub Actions, ubuntu-24.04)
• Coder version: n/a (repository CI)

Additional Context

The issue occurs consistently

---

This is currently affecting #27499. The CLA is signed and valid: the signature for Amadeus-22 (id 156959341) is recorded in coder/cla at v2022-09-04/signatures.json, and run 30312572901 confirms the check passed before the lock took effect. The only remaining failure is the locked-comment error above.

Could a maintainer unlock #27499? Once unlocked, a push to the branch should re-trigger contrib and let the cla check pass. I cannot comment on that PR to ask there, which is why I am opening this issue instead.