DCO is being enabled on all GitHub repositories

[Sealjay]

Developer Certificate of Origin¹ (DCO) is being enabled on all Green Software Foundation GitHub repositories - you may notice some changes, and this notice will explain the impact.

What is happening?

For people that are not part of Green Software Foundation member organisations, all commits attached to a pull request will need to be “signed” by the contributor.
This is possible through the web interface² on GitHub or the command line³: with -s.

Why are we doing this?

Background

In the Open Source WG, we noticed that we didn’t have a process for people that weren’t part of GSF member organisations to contribute - code or text - and validly donate their intellectual property.
This issue was raised to the steering committee, and weighing up Developer Certificate of Origin¹ versus signing a Contributor Licence Agreement, it was decided to adopt DCO across all GitHub repositories at the GSF.

Why

Once we have the DCO in place, we can accept (with normal due diligence) code, and other contributions from non-GSF members in our GitHub.

Before this change, we weren't accepting commits from people that are not at GSF member organisations.

What differences will I notice?

If you are at a Green Software Foundation member organisation, and you have been added to the Green Software Foundation organisation on GitHub as a member, then most of your activities day to day will remain the same.

You will see the following changes:

• Pull requests are automatically checked to make sure commits are either from a person at a GSF member organisation, or signed-off²³
• The web interface will now say "sign off and commit changes"⁴ when you create a commit online
• Commits from users that are not part of GSF member organisations, or that have not been added to the Green Software organization on GitHub will fail, when a pull request is raised.

What do I need to do?

If I am part of a Green Software Member organisation

For now, the check is disabled⁵ for commits authored and signed by members of the Green Software organization on GitHub.

It is still good practice to sign your commits on the command-line with s - on the web interface, this will be automatic.

If you notice your pull requests are failing, make sure a Green Software Foundation PM has added you to the GitHub.

If I am not part of a Green Software Member organisation

You will need to sign your commits with -s or on the web interface.

If you have commits already in pull requests, then you will need to retroactively sign those commits.⁶

On the web

When updates are being made through GitHub, for example, to markdown files, you will notice the commit header now says "Sign off and commit changes."⁴:

You won't need to take any other action².

On the commandline

Git has a -s command line option to append this automatically to your commit message³:
git commit -s -m 'This is my commit message'

You should append -s to all git commits going forward.

If I notice issues when committing to GitHub

If a pull request is failing, and it needs to urgently be committed - then a user with write access to the repository, such as the working group chair, or a GSF project manager, can override the check³.

This should only be done when we are sure that all commits are contributed by people at a GSF member organisation.

If I leave a Green Software Foundation Member organisation

If you leave the Green Software Foundation, then your previous commits will need signing.
For now and temporarily, Green Software Foundation PM can remediate commits that took place whilst you were part of a GSF member organisation.
Once we're in the habit of signing all commits, this issue shouldn't occur.

More information

Full text of the DCO available at https://developercertificate.org/

Footnotes

1. https://developercertificate.org/ ↩ ↩²

2. https://github.blog/changelog/2022-06-08-admins-can-require-sign-off-on-web-based-commits/ ↩ ↩² ↩³

3. https://probot.github.io/apps/dco/ ↩ ↩² ↩³ ↩⁴

4. https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-the-commit-signoff-policy-for-your-repository#about-commit-signoffs ↩ ↩²

5. https://github.com/dcoapp/app#skipping-sign-off-for-organization-members ↩

6. https://github.com/dcoapp/app#individual-remediation-commit-support ↩

[Sealjay]

@FabioTurati-NTT added this on Green-Software-Foundation/carbon-aware-sdk#309 (comment) :

If you have to modify some commits to add the sign-offs, an easy way is to use

* `git rebase -i <one commit before the first one you want to sign-off>`,

* change every action to `edit` instead of the default `pick`,

* then, for every commit, run
  
  * `git commit --amend -s`
  * close the editor with ctrl-x
  * `git rebase --continue`

That should do it!