Fix pre-existing legacy 502 - prod

[lukaszgryglicki]

cc @mlehotskylf @ahmedomosanya

Signed-off-by: Łukasz Gryglicki lgryglicki@cncf.io

Assisted by OpenAI

Assisted by GitHub Copilot

Assisted by Claude

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 49611294-0559-485f-a033-c8ca0acf90a8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The focused nil guard matches the repository contract and is covered by a regression test.

0 open findings

What changed in this PR

Prevents a missing signed CCLA from causing a production 502 in the v4 ECLA auto-create flow.

Changes:

• Returns HTTP 404 when no matching CCLA exists.
• Adds regression coverage for the nil-signature case.
• Adds a production ACS role-management helper.

File	Description
utils/​prod_acs_role_flip.sh	Adds the production operations helper.
cla-backend-go/​v2/​signatures/​handlers.go	Handles missing CCLAs safely.
cla-backend-go/​v2/​signatures/​handlers_sanctions_test.go	Verifies the 404 response.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[mlehotskylf]

This has the same diff as #5246, so the same feedback applies: the handler fix is good, but please drop utils/prod_acs_role_flip.sh before approval. Details: #5246 (review)

[lukaszgryglicki]

Same as #5246: the local-only util script stays in this PR (see replies there) - please re-review.

[Copilot]

🟢 Approval recommended

The guard matches the repository lookup contract and API specification, has targeted regression coverage, and the new script passes syntax validation.

0 open findings

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.