Setup accepting cncf cla/DCO before PR can be merged

[linsun]

No description provided.

[ilrudie]

Should I try to request access to be able to set this up? It doesn't seem like I have it right now.

[linsun]

Yes please :) Thanks!

[ilrudie]

Opened a request. We'll see what they say.

[linsun]

Looks like DCO is also acceptable and used by cncf/toc repo as well, along with linkerd2.

[ilrudie]

I added the CNCF/DCO-2 app to our org and set it up to check the community repo. https://github.com/k8sgateway/community/pull/43/checks?check_run_id=34563443814 is an example.

[ilrudie]

#37 now includes documenting the DCO requirements

[linsun]

Yay, awesome Ian!! Thanks!

[ilrudie]

Should we wait until this is enabled on kgw/kgw to close? Right now it's only on kgw/community

[linsun]

Ah, got it, reopen and closing it when you are ready :)

[ilrudie]

Need to revisit whether this is blocking acceptance into the CNCF sandbox. The DCO experience was bad for developers.

cc @linsun

[craigbox]

It will not block acceptance but it's on the list of things you do to onboard to set up one of the other, with DCO preferred.

TBH I hear @ilrudie but I think DCO is much lower effort if you're required to get a corporate CLA signed.

[ilrudie]

We can adopt whichever the community prefers. I long ago developed a personal habit of cryptographically signing as well as "signing off on" every commit I make so this is a moot point for me.

Since other folks found it to be bad, and we were generally sympathetic to "feels bad even if good for project", I backed DCO out to ease the pain pending further discussion.

[craigbox]

we need to tell people to put the following in .git/hooks/commit-msg (one time)

#!/bin/sh
SIGNATURE="Signed-off-by: `git config --global --get user.name` <`git config --global --get user.email`>"
grep -qs "^${SIGNATURE}" "$1" || echo "\n${SIGNATURE}" >> "$1"

[ilrudie]

Yeah, we can make some recommendations to ease the pain. We also probably need to document "Oops, 10 commits with no signoffs... now what?" It's gunna happen to most fly by contribs I expect and instead of "go sign this web form and ask someone to rerun the CLA test" you're gunna get into some git gymnastics and a force push.

[craigbox]

Feel free to lift https://github.com/kubescape/project-governance/blob/main/CONTRIBUTING.md#sign-your-commits

(the linked src-d guide is CC-BY-SA-4.0 licensed and unmaintained; we could inherit that too.)