Drop the DCO sign-off requirement - #16
Open
xaleryb wants to merge 1 commit into
Open
Conversation
Removes the gate and every document that asked for it, in one change. Half of it would have been worse than either whole: dropping `dco.yml` alone leaves the README, CONTRIBUTING and the PR checklist stating a rule nothing enforces, and keeping the gate leaves a check an outside contributor cannot make green without being told, in a repository whose whole point is to lower the entry cost. What goes: - `.github/workflows/dco.yml` — the `signed-off` check. It is posted by `github-actions`, not by a DCO GitHub App, so deleting the workflow removes the check itself; no ruleset on `main` requires any status check. - `CONTRIBUTING.md` — the `### Sign your work` subsection (the DCO 1.1 text, the real-name rule, the `--amend -s` / `--signoff` recovery), and `-s` from the quickstart. `## Licence and sign-off` becomes `## Licence`, and the inbound- licence paragraph stays — it is the part that carries the legal weight. - `README.md` — the `git commit -s` step, the "every commit carries a DCO sign-off" bullet under what CI checks, and the DCO paragraph under Licence and governance. - `.github/pull_request_template.md` — the sign-off checkbox. - `MAINTAINERS.md` — the `dco.yml` row in the CI table. No licence hole is opened. Apache-2.0 section 5 makes a contribution intentionally submitted for inclusion inbound-licensed by default, and CONTRIBUTING.md says so in its own words as well. The sign-off added a per-commit attestation, a real-name rule and a git paper trail on top of that — not the licence.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Removes the DCO sign-off requirement from this repository: the
signed-offgate and everydocument that asked for a
Signed-off-bytrailer, in one change..github/workflows/dco.ymlis deleted.CONTRIBUTING.mdloses the### Sign your worksubsection — the DCO 1.1 text, the real-name rule, the
--amend -s/--signoffrecovery —and
-sfrom its quickstart;## Licence and sign-offbecomes## Licenceand keeps theinbound-licence paragraph, which is the part that carries the legal weight.
README.mdlosesthe
git commit -sstep, the "every commit carries a DCO sign-off" bullet under what CIchecks, and the DCO paragraph under Licence and governance. The PR template loses its
sign-off checkbox and
MAINTAINERS.mdloses thedco.ymlrow from the CI table.Why the whole thing, and not just the gate
Either half alone is worse than either whole. Delete
dco.ymland keep the text, and theREADME, CONTRIBUTING and the checklist all state a rule nothing enforces. Keep the gate and
it stays what it has been in practice: a red check an outside contributor cannot make green
without being told about it first, in a repository whose stated purpose is a low entry cost.
This is not hypothetical here — the last pull request from a fork landed with
signed-off: failurefor exactly that reason.No licence hole
Apache-2.0 section 5 makes a contribution intentionally submitted for inclusion
inbound-licensed by default, and
CONTRIBUTING.mdsays the same thing in its own words —that paragraph is untouched. The sign-off added a per-commit attestation, a real-name rule
and a git paper trail on top of a licence that did not need them.
Nothing outside the repository has to change
signed-offcheck is posted bygithub-actions, not by a DCO GitHub App, so deletingthe workflow removes the check itself rather than leaving an orphan.
mainhas no required status checks to unpin: the only rules on it aredeletionandnon_fast_forward, both sourced from this repository, and there is no classic branchprotection.
needs:on it, and no badge or documentation anchor points at it.One question for whoever approved publication
CONTRIBUTING.mdintroduced the removed section as Intel's standard contributor text andstated that the DCO "may not be changed by anyone". That reads like it could be an Intel OSPO
requirement rather than a choice this repository made, in which case this pull request needs
their sign-off before it lands — worth confirming either way.
Note on the source branch
Deliberately opened from a fork rather than a branch here, so the pull request that removes
the contributor gate is itself made through the contributor path.
Checklist
python3 tools/validate_skills.pypasses locally, along withactionlintandzizmorover
.github/workflows/.descriptionto re-test.