Add CLA workflow

[Fionoble]

Summary

• Add the Shopify CLA GitHub Actions workflow used by Shopify/ui-extensions
• Run the CLA check on PR open/sync and rerun it when contributors comment that they have signed the CLA
• Grant the workflow the permissions recommended by Shopify/shopify-cla-action

Verification

• Compared against Shopify/ui-extensions/.github/workflows/cla.yml
• Ran git diff --check
• Secure GHA lint passed on this PR

Follow-up

CLA_TOKEN is expected to be available org-wide. After this merges, future PRs should get a cla check from Contributor License Agreement (CLA). If we want GitHub branch rules to hard-block merges specifically on that check, add cla as a required status check once the workflow has run at least once.

[caution-tape-bot]

👋 It seems that this PR is adding, or editing, a GitHub Action workflow that is not configured to use our custom GitHub Action runners.

For private repositories, the only supported way of running Action workflows is via the custom runners. You can learn more about the supported use cases in our GitHub Actions documentation.

To make sure that your workflow is using these runners you need to add the shopify-ubuntu-latest label to your workflow manifest file, or shopify-core-ubuntu-latest for Core repositories:

runs-on: shopify-ubuntu-latest

If your repository is intended to become Public later, please use runs-on: shopify-ubuntu-latest for now. The custom runners should function the same as ubuntu-latest public runners, though the exact Ubuntu version may vary. Please see the section below for more information about OS selection on premium runners.

If you run into any issues with the custom runners, please reach out in help-eng-infrastructure on Discourse.

Note for OS Versions

The shopify-ubuntu-latest runners can select from two different runner pools, which contain both Ubuntu 20.04 and Ubuntu 22.04 machines. For some workflows, this can cause issues.

To use Ubuntu 20.04 only, you can specify runs-on: shopify-ubuntu-20.04.

To use Ubuntu 22.04 only, you can specify runs-on: shopify-ubuntu-latest-2.

---

This comment was added by the GitHubActions::Workflow Caution Tape Bot rule.
View the source of this rule in Services DB

Warning

CautionTapeBot Deprecation Notice

CautionTapeBot is being deprecated and will be sunset in Q1 2026. Please plan to migrate your workflows.

📚 View full deprecation guide and migration instructions