DCO Policy for bots?

[vsoch]

Hey CNCF!

We added a small contributors bot to our repository, and he basically looks for new contributors to the code, and then opens a pull request to update a metadata file and a pretty rendering in the README.md so we can put contributors front and center.

However, after his first run I realized that his PRs will never be acceptable because the GitHub bot cannot sign the commits (and thus pass the DCO check). An example is here: https://github.com/oras-project/oras-py/pull/18/checks?check_run_id=6585218827

We currently have that workflow disabled until further discussion about what we might do. I was pointed here to y'all and I thought you might have a good idea, e.g., how have other projects that want a bot to do some automation handled this issue?

ping @sajayantony

Thank you!

[dims]

@vsoch in https://github.com/oras-project/oras-py/blob/main/.github/workflows/update-contributors.yaml#L56 can you not add the Signed-off-by explicitly?

[caniszczyk]

+1 to what Dims said, just have the bot sign off with an email and it work This is what the GitHub dependabot does and it works

…

On Thu, May 26, 2022 at 9:34 AM Davanum Srinivas ***@***.***> wrote: @vsoch <https://github.com/vsoch> in https://github.com/oras-project/oras-py/blob/main/.github/workflows/update-contributors.yaml#L56 can you not add the Signed-off-by explicitly? — Reply to this email directly, view it on GitHub <#352 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAPSIMFSSCJXJPVMYVUZULVL6DYFANCNFSM5W6QTQXA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

-- Cheers, Chris Aniszczyk https://aniszczyk.org

[vsoch]

oh wow, that's a very simple solution! Indeed I will try that and report back. Thanks @dims and @caniszczyk !

[vsoch]

Worked like a charm! For future readers of this post, what I wound up doing it:

git commit -a -m "Automated deployment to update contributors ${today}" -m "Signed-off-by: github-actions <github-actions@users.noreply.github.com>"

If you do a newline in -m it's not honored (and won't work) and neither will using a name / email that is not the actual author of the commit.

Thank you again!