[BUG] Could not retrieve whitelisted email domains

[Alan-Ryan]

From slack:
https://the-cmf.slack.com/archives/C03PCFSB690/p1774547368952599

Strange CLA failure in
rdkcentral/meta-vendor-raspberrypi-dev#335
Run rdkcentral/contributor-assistant_github-action@v2.7.0
CLA Assistant GitHub Action bot has started the process
Error: Could not retrieve whitelisted email domains. Status: 4
Re-running the GH Action fixes it.

Steps To Reproduce
?

Expectation
the action not to error with 'Error: Could not retrieve whitelisted email domains. Status: 4'

[Alan-Ryan]

The reusable workflow in cmf-actions/.github/workflows/cla.yml passes domain-allow-list-file: 'domains.json' to rdkcentral/contributor-assistant_github-action@v2.7.0. The action attempts to fetch this domains.json from the rdkcentral/cla_signatures repo using PERSONAL_ACCESS_TOKEN (CLA_ASSISTANT). It got HTTP 403 on attempts 1 and 2, then succeeded on attempt 3.

Three possible causes (in order of likelihood):

1. Transient PAT permissions issue — The CLA_ASSISTANT token briefly lost read access to rdkcentral/cla_signatures (e.g., an org permission policy that flapped, or the token hit a rate limit). Since attempt 3 passed without any code change, this is the most likely explanation.

2. The domains.json file does not exist in rdkcentral/cla_signatures — If the file is absent, the API may return 403 instead of 404 depending on repo visibility. Worth checking that the file actually exists there.

3. PAT approaching expiry — If CLA_ASSISTANT was created ~11 months ago and set to expire at 1 year, it may intermittently fail as it nears expiry. Check the PAT's expiry date in GitHub org secrets settings.

Steps:

1. Confirm rdkcentral/cla_signatures/domains.json exists. File exists at source and has been in use.
2. Check CLA_ASSISTANT PAT expiry. Rotated today, was to expire in a couple of weeks.
3. Check PAT scopes. scopes ok.

---

Monitor

• if the 403 recurs consistently (not just transiently), the PAT scope or file existence may be the culprit.
• If it only appears occasionally and re-runs succeed, it's transient GitHub API behaviour.