Current state
- 1 of the last 20 commits carries
Signed-off-by.
- No DCO check exists.
.github/workflows/ has 10 workflows, none of
which verify sign-off.
- Repo is Apache-2.0.
Why now
PR #434 adds AI_POLICY.md, whose "Signed-off-by and Developer
Certificate of Origin" section requires human contributors to add their
own Signed-off-by and prohibits AI agents from adding one. That
section describes a process that is not currently enforced.
Options
- GitHub's DCO app (https://github.com/apps/dco) -- adds a required
status check, no workflow to maintain.
- A CI workflow check -- more control over exemptions and error
messaging, one more workflow to own.
Decisions needed
- Retroactive or forward-only? Enforcing against existing history
would fail nearly every open PR. Forward-only (check only the commits
in a PR) is the usual choice.
- Bot exemption. Dependabot commits appear throughout recent history
and do not sign off. Both options above support bot allowlists; pick
one explicitly rather than discovering it on the first failing
Dependabot PR.
- Contributor impact. Enforcement means every contributor needs
git commit -s or equivalent. Worth a line in CONTRIBUTING.md at
the same time.
Related
Current state
Signed-off-by..github/workflows/has 10 workflows, none ofwhich verify sign-off.
Why now
PR #434 adds
AI_POLICY.md, whose "Signed-off-by and DeveloperCertificate of Origin" section requires human contributors to add their
own
Signed-off-byand prohibits AI agents from adding one. Thatsection describes a process that is not currently enforced.
Options
status check, no workflow to maintain.
messaging, one more workflow to own.
Decisions needed
would fail nearly every open PR. Forward-only (check only the commits
in a PR) is the usual choice.
and do not sign off. Both options above support bot allowlists; pick
one explicitly rather than discovering it on the first failing
Dependabot PR.
git commit -sor equivalent. Worth a line inCONTRIBUTING.mdatthe same time.
Related