The cla-check workflow checks if the author of a PR has signed a CLA. The signatures are recorded in the cla-check repo.
If you want to add this CLA check to a public repo, just copy the cla-check.yml to the repos /.github/workflows/ directory.
NOTICE: The action depends on the REPO_CLABOT_READ_CONTENT_ACCESS org secret. This is a PAT that needs refreshed once a year (defined by org policy for create). We are limited to using these legacy PAT as we have the workflow in one repo (this) and call it from another repo. See this discussion for why.
The PAT must have READ access to all repos and stored in the REPO_CLABOT_READ_CONTENT_ACCESS org secret.