You don't need a CLA. Github's ToS are set up such that contributions you get from other github users are licensed in the same manner as your repo unless the contributor gets you to agree to accept them under some other license : https://docs.github.com/en/site-policy/github-terms/github-t.... People should not be worried about you "going private"; if you've accepted non de minimis contributions from other users, any future conveyance or network interaction stuff would require you to include the source materials to stay in compliance.