ci: Remove DCO Checks from all InstructLab repositories

[courtneypacheco]

This document proposes the removal of explicit DCO checks from all InstructLab repositories. If explicit DCO checks are removed, then contributors no longer have to "sign off" each commit.

[ktdreyer]

Thanks Courtney! I support this idea because

• Several editors (like GitHub's web UI) do not add these lines to commit logs.
• New contributors do not always have advanced Git knowledge to amend commit messages.
• The DCO Bot sometimes has outages, delaying merging PRs.

[jjasghar]

I thought the DCO thing was from Red Hat/IBM Legal. I strongly suggest we get legal entities to sign off on this before we continue moving forward.

[jjasghar]

Comment above.

[booxter]

I believe legal did sign off on this, but @ktdreyer could share specific snippet I guess.

[ktdreyer]

I've checked with RH Legal on this and they've agreed to this change.

[jjasghar]

Not that I don't trust you, but I we need some level of paper trail with this. @lhawthorn can you advise here? I'm not comfortable signing off on this as an OC committee member without seeing the paper trail.

[lhawthorn]

It is a requirement from the legal team. Following up via real time chat, will summarize outcome in this PR.

[lhawthorn]

Hi Folks, after a long session of hashing out in real time chat about legal requirements and the DCO, I am asking that we keep DCO for any submissions to the taxonomy repo, as removing it has significant implications for the community model rebuild work.

I leave it to other folks who are focused on the workflow for InstructLab mechanics vs. contributions to the community model build to understand if there are further implications to removing the DCO from other repos, but I do not immediately identify them.

Pinging also @instructlab/ui-maintainers because the DCO is part of their UI workflow and this change will possibly have implications for them.

[markstur]

• Several editors (like GitHub's web UI) do not add these lines to commit logs.

The org has sign-off via web ui enabled so it should be just a checkbox.

[markstur]

There is an alternative CLA process so that contributors agree that they have agreed to the contributor agreement. It is much worse than DCO sign-off.

[vishnoianil]

Pinging also @instructlab/ui-maintainers because the DCO is part of their UI workflow and this change will possibly have implications for them.

UI has DCO workflow because taxonomy requires DCO, even if taxonomy doesn't require it in future, we can still keep signing-off the commits, because UI does the signoff on behalf of the user. To contribute to the UI project itself, it can adopt any guidelines.

In my humble opinion, signoffs and CLAs are considered best practices. Signoff enforces that user have a Name on the profile and primary email address. Incase user is unresponsive (may be filtering github notifications) we can reach out through email address if requires. It gives an alternate communication channel apart from github comments.

[markstur]

Pinging also @instructlab/ui-maintainers because the DCO is part of their UI workflow and this change will possibly have implications for them.

UI has DCO workflow because taxonomy requires DCO, even if taxonomy doesn't require it in future, we can still keep signing-off the commits, because UI does the signoff on behalf of the user. To contribute to the UI project itself, it can adopt any guidelines.

In my humble opinion, signoffs and CLAs are considered best practices. Signoff enforces that user have a Name on the profile and primary email address. Incase user is unresponsive (may be filtering github notifications) we can reach out through email address if requires. It gives an alternate communication channel apart from github comments.

I think it's not just so they have a name/email, but it is (somehow) implied that by signing the commit they are agreeing to the terms of the DCO, which gives us the rights to the code, and states that they had the rights to give it to us. It's like signing a contract (maybe w/o reading the contract). No take backs.

I'm definitely not a lawyer though.

[github-actions]

This pull request has been automatically marked as stale because it has not had activity within 30 days. It will be automatically closed if no further activity occurs within 7 days.

[github-actions]

This pull request has been automatically closed due to inactivity. Please feel free to reopen if you intend to continue working on it!

[RobotSail]

So it sounds like we are all good to remove DCO, just taxonomy needs to keep it. @jjasghar it looks like you have requested changes, is there anything else you feel is missing currently?

[ktdreyer]

This blocked another contributor's PR recently instructlab/training#578 and I think we should merge this and implement it.

[RobotSail]

I agree @ktdreyer , it seems like we can go ahead and merge this since I haven't heard any objections since the last message.

The contributor had enough time to express concerns. If these are still valid, feel free to raise a new issue or revert the patch.

[booxter]

@courtneypacheco @ktdreyer do you plan to take care of the execution here? (Putting DCO.txt per repo etc.)

[ktdreyer]

I can do this for the four repos where this will have the most immediate impact: instructlab core, eval, sdg, and training.

[ktdreyer]

@booxter you were right in your earlier comments about dropping the mergify config. We do need to drop the mergify gates prior to updating our DCO settings for our instructlab org to shut the job off altogether.

I'll push PRs to do that now.

[ktdreyer]

I've disabled the DCO requirement in GitHub settings now for all repos except taxonomy.

[booxter]

For some reason, I still see DCO check pending on patches in library repos.

[ktdreyer]

I found that DCO was also set on our "protected branches". I have removed these on all protected branches for instructlab (core), sdg, eval, and training.

[ktdreyer]

Courtney has disabled it on examples today also.