caa: allowlist logins only (gafferongames,rowan-claude)

.github/workflows/cla.yml

@@ -131,8 +131,20 @@ jobs:
           branch: cla-signatures
           path-to-signatures: signatures/caa.json
           path-to-document: https://github.com/mas-bandwidth/.github/blob/main/CAA.md
-          # our own accounts and bots never need to sign
-          allowlist: gafferongames,rowan-claude,*[bot]
+          # LOGINS ONLY (Glenn, 2026-10-22: "remove all name entries from the CAA
+          # allowlist in every repo, allow-list logins only"; "So it's my login
+          # and yours"). The action matches a commit that has no linked GitHub
+          # account by its git author NAME, which anyone can set, so every name
+          # entry, and every wildcard (*[bot] included: the name match applies
+          # to it too), let an outsider skip the CAA. A login is verified by
+          # GitHub and cannot be spoofed. Our agents commit as
+          # Rowan Claude <305107455+rowan-claude@users.noreply.github.com>,
+          # which GitHub links to the rowan-claude login. The action always
+          # skips github-actions[bot] itself (user id 41898282); any other bot,
+          # dependabot included, is not on this list and fails it. Never add a
+          # name or a wildcard here: a red caa check is fixed by committing
+          # under a linked identity, never by widening this list.
+          allowlist: gafferongames,rowan-claude
           custom-notsigned-prcomment: 'Thanks for the contribution. Before it can be merged, please read the [Contributor Assignment Agreement](https://github.com/mas-bandwidth/.github/blob/main/CAA.md) and sign it by posting the exact sentence below as a comment on this PR.'
           custom-pr-sign-comment: 'I have read the CAA and I hereby sign it, assigning copyright in my contributions to Más Bandwidth LLC.'
           custom-allsigned-prcomment: 'All contributors have signed the CAA. Thank you.'