30-second answer

MIT, inbound equals outbound, DCO 1.1 sign-off on every commit, and no CLA.

Inbound equals outbound

Everything you contribute is licensed under the same MIT Licence the project is released under. There is no separate grant, and nothing you send is licensed on terms the rest of the project does not already have.

There is no CLA, and there will not be one. A contributor licence agreement asks you to assign or license rights beyond the project's own licence, usually to a company. That would make the repository's licence and its contributors' obligations two different things. Inbound equals outbound keeps them one thing.

Sign your commits off

Under DCO 1.1. The Developer Certificate of Origin is a statement that you have the right to send what you sent, not a transfer of anything.

Bash
git commit -s

which adds:

Text
Signed-off-by: Your Name <your.email@example.com>

The name and address must be real and must be the ones you commit under. CI refuses a pull request whose commits are not signed off, and it names the commits rather than failing with a tick nobody can act on.

If you forget, git rebase --signoff from the merge base fixes a branch, and the refusal prints the exact command.

Two boundaries on the sign-off rule

History from before the policy is not reopened. The rule applies to commits a pull request introduces, measured from the merge base. Rewriting published history would change every hash on the default branch, break every link and clone that refers to them, and re-certify years of work retroactively, which is the opposite of what a certificate means.

Nobody signs for anybody else. A sign-off by someone other than the author is a certificate about work the signer did not write, and the gate refuses it. If a commit on your branch is not yours, its author adds the sign-off; a maintainer will not add one on their behalf.

Pull requests

One rule, or one coherent change, per pull request.

Say what kind of claim you are adding and why you classified it that way. That sentence is the review.

Commit messages: what changed and why it matters, in prose, without a prefix convention. If a commit needs a bullet list to be understood, it is probably two commits.