docs: adopt DCO and AI-disclosure contribution policy - #84
Conversation
Add a DCO status check requiring every human-authored commit to carry a Signed-off-by trailer matching the commit author or committer, certifying https://developercertificate.org. Bot-opened PRs (Dependabot, release-please) are exempt and merge commits are skipped. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: kperry <kperry@godaddy.com>
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to enforce Developer Certificate of Origin (DCO) sign-off on pull requests, aligning contributions with the Linux Foundation model by validating Signed-off-by: trailers on commits.
Changes:
- Introduces a
DCOworkflow triggered on PR events to validateSigned-off-by:trailers per commit. - Skips merge commits and bot-authored commits; exempts bot-opened PRs at the job level.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| contents: read |
| fi | ||
| done | ||
| if [ "$ok" -ne 1 ]; then | ||
| echo "::error::commit ${sha} has no Signed-off-by matching its author or committer (${author_email})" |
Add Developer Certificate of Origin, AI-Assisted Contributions, and Linking Issues sections to the contributing guide, matching the org-wide PR template and the DCO check introduced on this branch. Also fix stale godaddy/* repository links left over from the repo move. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: kperry <kperry@godaddy.com>
Replace the inlined check with a thin caller of agentnameservice/.github/.github/workflows/dco-check.yml@main so the policy is maintained in one place. This check errors until agentnameservice/.github#6 merges (merge that first). Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: kperry <kperry@godaddy.com>
|
Merge-order note: the DCO check was refactored to call the org-shared reusable workflow in agentnameservice/.github (agentnameservice/.github#6). Until that PR merges, the check here fails with workflow not found — merge agentnameservice/.github#6 first, then re-run this check (or push any update). |
DCO enforcement moves to https://github.com/apps/dco — the standard across Linux Foundation projects — which validates sign-offs per commit and exempts bot-authored commits and merges by default. Drop the Actions workflow and point CONTRIBUTING at the app. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: kperry <kperry@godaddy.com>
kperry-godaddy
changed the title
|
Update: enforcement moved from a per-repo Actions workflow to the org-wide DCO app (the LF standard, bot commits exempt by default). The workflow file was removed from this branch — this PR is now docs-only, and the earlier merge-order note no longer applies. |
The DCO app does not report on merge_group commits, so a required DCO check would stall this repo's merge queue. This static shim passes the DCO check for merge groups only; real validation happens on the pull request via the app. Same pattern as onnx/onnx#5399. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: kperry <kperry@godaddy.com>
|
Added a merge-queue shim (this repo runs a merge queue): the DCO app does not report on |
Related issue
Fixes #83
Summary
Documents the org's adoption of the Linux Foundation contribution model in
CONTRIBUTING.md: Developer Certificate of Origin sign-off (git commit -s), AI-assistance disclosure per the kernel convention, and issue-linking for every PR. Enforcement comes from the org-wide DCO app — the LF/CNCF standard, validating sign-offs per commit with bot-authored commits (Dependabot, release-please) and merges exempt — so no per-repo workflow is required. (Earlier revisions of this branch carried an Actions-based check; it was dropped in favor of the app.)Also fixes stale
godaddy/*repository links left from the repo move.Testing
Docs-only change; DCO enforcement itself is validated by the app on pull requests once installed org-wide.
AI assistance
Assisted-by: Claude Code (claude-fable-5)
Checklist
git commit -s) certifying the DCO🤖 Generated with Claude Code