The repository already refuses commits without a sign-off. The check walks every
non-merge commit in a pull request and requires a Signed-off-by trailer that
matches the commit author exactly, and when it refuses one it tells the
contributor to read two files:
gh api repos/Flowfin/core/contents/.github/workflows --jq '.[].name'
dco.yml
dependency-review.yml
scorecard.yml
unicode-guard.yml
zizmor.yml
gh api repos/Flowfin/core/contents --jq '.[].name'
.github
NOTICE.md
README.md
Neither file exists. So the first contribution this repository ever receives is
refused, correctly, with a pointer at nothing, and the contributor is asked to
certify something they cannot read. #23 writes the second of the two files. This
issue lands the first.
The text is not ours to compose. The Developer Certificate of Origin version 1.1
is a fixed instrument, and a paraphrase of it is a different instrument that no
contributor has agreed to and that no other project's sign-off means. It goes in
unaltered or it is not the DCO.
What this produces
DCO at the root, carrying the version 1.1 text with nothing added to it and
nothing taken out.
The sentence that tells somebody how to satisfy it, in whichever of README.md
or the contributing document #23 decides, naming git commit -s and saying that
the trailer has to match the commit author, since the check compares the whole
line rather than the address alone. A contributor whose git identity differs
from the trailer is refused for a reason that reads as a bug until it is written
down.
Done when
DCO exists at the root and gh api repos/Flowfin/core/contents --jq '.[].name'
lists it. A pull request whose commits carry a matching trailer passes the
sign-off check, one without it is refused, and the message it prints on refusal
names files that now exist. Blocked on #23 for the sentence, not for the file.
The repository already refuses commits without a sign-off. The check walks every
non-merge commit in a pull request and requires a
Signed-off-bytrailer thatmatches the commit author exactly, and when it refuses one it tells the
contributor to read two files:
Neither file exists. So the first contribution this repository ever receives is
refused, correctly, with a pointer at nothing, and the contributor is asked to
certify something they cannot read. #23 writes the second of the two files. This
issue lands the first.
The text is not ours to compose. The Developer Certificate of Origin version 1.1
is a fixed instrument, and a paraphrase of it is a different instrument that no
contributor has agreed to and that no other project's sign-off means. It goes in
unaltered or it is not the DCO.
What this produces
DCOat the root, carrying the version 1.1 text with nothing added to it andnothing taken out.
The sentence that tells somebody how to satisfy it, in whichever of
README.mdor the contributing document #23 decides, naming
git commit -sand saying thatthe trailer has to match the commit author, since the check compares the whole
line rather than the address alone. A contributor whose git identity differs
from the trailer is refused for a reason that reads as a bug until it is written
down.
Done when
DCOexists at the root andgh api repos/Flowfin/core/contents --jq '.[].name'lists it. A pull request whose commits carry a matching trailer passes the
sign-off check, one without it is refused, and the message it prints on refusal
names files that now exist. Blocked on #23 for the sentence, not for the file.