[Feature Request] Verify Developer Certificate of Origin (DCO) in the CI

[gabrieldemarmiesse]

Review Mojo's priorities

• I have read the roadmap and priorities and I believe this request falls within the priorities.

What is your request?

It would be cool to have a CI check in PRs that verifies the DCO

What is your motivation for this change?

I sometimes forget to add the DCO in my commits' logs. Also it seems that the new contributors sometimes forget the DCO, it would be great to have the CI help them learn the procedure instead of a human.

Any other details?

I don't know any tool that will automatically do it. Worst case scenario we can do this by hand with a python script running inside a github action.

[gabrieldemarmiesse]

I'm seeing more and more PRs failing to add DCO and taking maintainers' time:

• [mojo-stdlib]Use variadic initializer of List in tests #2074 (comment)
• Fix small typo time.mojo #2067
• [Docs] fix the url of 'write your first Mojo program' in README.md #2056
• [mojo-stdlib]Add list.pop(index) API to stdlib #2041
• [mojo-stdlib][docs] Update docs and code to use from <module> import <entity> instead of from <module>.<file> import <entity> #2039
• [mojo-stdlib] Export InlinedFixedVector from collections #2047 (comment)

I looked into making it easier to handle the DCO. Here is what I advise:

1 - Require contributors to sign off on web-based commits

This can be enabled by going in the settings of the repository modularml/mojo:

If this is causing issues, we can always uncheck the box later

2 - Add a DCO check in the CI

I looked around and it seems everyone is using https://github.com/dcoapp/app to do this. You can take a look at the app in action here: openhab/openhab-core#4161
Here is what it looks like when you click on the failed build details (click on the image to make it bigger if needed):

Note that, as maintainers, you can force the check to be green if needed by clicking "Set DCO to pass" in the PR build if needed.
To enable this app, go to https://github.com/apps/dco and click "install" select the Mojo repository during the configuration.

3 - Skip DCO check for organisation members

I seems that modular staff doesn't include the DCO, thus it should not be required for them. Here is the option to do it: https://github.com/dcoapp/app?tab=readme-ov-file#skipping-sign-off-for-organization-members
You just have to add a config file in the repo. I already tried with a dummy repository, here is what it looks like: https://github.com/gabrieldemarmiesse/wine-prediction/blob/master/.github/dco.yml
As you can see, it's quite simple.

4 - Make the DCO a required check in the pull request, preventing merging:

Follow the instructions here: https://github.com/dcoapp/app/blob/main/docs/required-statuses.md to do it.

This should make it easier for newcomers to contribute, as they will have fast feedback and instructions to fix their DCO, and it will take way less time for maintainers as they won't need to manually check the DCO or explain to users how to fix it.

[gabrieldemarmiesse]

@ConnorGray @JoeLoser that might save you some time :)

[JoeLoser]

@ConnorGray @JoeLoser that might save you some time :)

Thanks a lot for researching this — very helpful! @ConnorGray is going to look into this as part of other work for improving PR review for us such as making sure people are targeting the nightly branch and that PRs include appropriate title [tags]. We have a PR linter internally that we'll apply upstream here as well.

Going to go ahead and assign @ConnorGray to this GH issue.

[ematejska]

We actually already have the #1 option enabled where the github checkbox is clicked so wondering what the issue is with that that necessitates more.

[ConnorGray]

Fixed by adding the DCO app described above to the mojo repository.

Thanks @gabrieldemarmiesse for putting all this information together, it was very helpful! 🙂