GitHub would shut off Probot DCO App in approximately 4 weeks

[lloydchang]

@todaywasawesome @scottrigby @murillodigital
FYI: GitHub would shut off Probot DCO App in approximately 4 weeks
Details at:

1. DCO Expected — Waiting for status to be reported  dcoapp/app#162 (comment)
2. DCO Expected — Waiting for status to be reported  dcoapp/app#162 (comment)
3. DCO Expected — Waiting for status to be reported  dcoapp/app#162 (comment)
4. DCO Expected — Waiting for status to be reported  dcoapp/app#162 (comment)
5. Provide implementation guidance for DCO/CLA openjs-foundation/cross-project-council#632 (comment)
6. DCO Expected — Waiting for status to be reported  dcoapp/app#162 (comment)
7. DCO Expected — Waiting for status to be reported  dcoapp/app#162 (comment)

Thank you!

[lloydchang]

Tangentially, I just copied https://github.com/gitops-working-group/gitops-working-group/discussions/174 discussion to this #27 in alignment with the moving plan described at cncf/tag-app-delivery#146 (comment)

@scottrigby wrote:

the current plan is to move relevant GH "projects" from the WG to https://GitHub.com/open-gitops/project

[scottrigby]

Until there's a new standard tool, I like what I see from the keptn folks implementation dcoapp/app#162 (comment)

@mowies how has your dco gh action been working out for you all since implementing it? Any issues?

[mowies]

Hi @scottrigby !
So, since this whole thing went does with the DCO GH App not responding anymore, a few things happened:

• the keptn project looked for an alternative to the GH app to still have some DCO check since it is obligatory for CNCF projects
• I implemented a small pipeline under the keptn GH org which takes a different dco checker tool and uses it in all the keptn PRs. you can find that in this repo
• that pipeline then got donated to the CNCF and now also lives here
• In keptn, we left both my new pipeline and the DCO GH app running just to see whether the DCO app would actually be shut down in the end.

The current state of DCO in the keptn project:

• We are still using both DCO checkers now
• The DCO App is still online and can be used normally
• You can also use our separate DCO pipeline or the CNCF donated one at any time if you want to
• In the keptn project, we plan to try out EasyCLA instead of DCO in the future but no timeline or results yet
• We had one issue with the custom implemented DCO pipeline:
  • When a dev branch (dev branch 1) is used as base for another dev branch (dev branch 2) which is the merged back into the dev branch 1, the DCO pipeline will then complain in the dev branch 1 PR that the DCO is not met because there are some committer mail address mismatches. It can't handle the GitHub no-reply mail addresses that are used in commits after a merge if the committer has some specific privacy settings around their mail address on GitHub.
  • Example: feat: Resource service endpoint handler implementation(#6346) keptn/keptn#6461 with the failing DCO check: https://github.com/keptn/keptn/runs/4702772622?check_suite_focus=true

[scottrigby]

@mowies Thank you! 👏🙇