[Action] DCO enabled on GSF GitHub

[Sealjay]

Developer Certificate of Origin¹ is being enabled at the Green Software Foundation:
https://github.com/orgs/Green-Software-Foundation/discussions/5

If you primarily change markdown files and other documents through the web interface, you should notice minimal changes.

Software developers will need to sign their commits on the commandline with -s.

Once enabled, your project will be able to accept code and text via Pull Request, from people that are not at Green Software Foundation member organisations.

For more information on the impact, rationale, and to ask any questions, please see the discussion.

Footnotes

1. https://developercertificate.org/ ↩

[Willmish]

FYI: @bderusha @pritipath @gfmatthews @juzuluag @JenMadiedo

The current PRs (ones which did not go through DCO check) will go through, and we can overwrite this manually and approve the sign-offs on the check, but for future PRs it will be smoother if all commits are signed off (-s flag set in git commit)

[FabioTurati-NTT]

If you have to modify some commits to add the sign-offs, an easy way is to use

• git rebase -i <one commit before the first one you want to sign-off>,
• change every action to edit instead of the default pick,
• then, for every commit, run
  • git commit --amend -s
  • close the editor with ctrl-x
  • git rebase --continue

That should do it!

[Sealjay]

If you have to modify some commits to add the sign-offs, an easy way is to use

* `git rebase -i <one commit before the first one you want to sign-off>`,

* change every action to `edit` instead of the default `pick`,

* then, for every commit, run
  
  * `git commit --amend -s`
  * close the editor with ctrl-x
  * `git rebase --continue`

That should do it!

Thanks @FabioTurati-NTT ! Quoted you here: https://github.com/orgs/Green-Software-Foundation/discussions/5#discussioncomment-5336378

[Willmish]

Hi and thanks for adding this @FabioTurati-NTT , however according to the logs from the workflow the preferred method of applying DCO signoffs if they were missing in previous commits, is to add a remediation commit

Preferred method: Commit author adds a DCO remediation commit

A DCO Remediation Commit contains special text in the commit message that applies a missing Signed-off-by line in a subsequent commit. The primary benefit of this method is that the project’s history does not change, and there is no risk of breaking someone else’s work.

These authors can unblock this PR by adding a new commit to this branch with the following text in their commit message:

Here is what they say as to the alternative method - rebasing:

Least preferred method: Rebase the branch

If you have a local git environment and meet the criteria below, one option is to rebase the branch and add your Signed-off-by lines in the new commits. Please note that if others have already begun work based upon the commits in this branch, this solution will rewrite history and may cause serious issues for collaborators (described in the git documentation under "The Perils of Rebasing").

You should only do this if:

You are the only author of the commits in this branch
You are absolutely certain nobody else is doing any work based upon this branch
There are no empty commits in the branch (for example, a DCO Remediation Commit which was added using --allow-empty)

To add your Signed-off-by line to every commit in this branch:

Ensure you have a local copy of your branch by [checking out the pull request locally via command line](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/checking-out-pull-requests-locally).
In your local branch, run: git rebase HEAD~5 --signoff
Force push your changes to overwrite the branch: git push --force-with-lease origin 240/unit-tests-review

I added my thoughts as to why this should be made more clear in the docs of the DCO bot in this issue: dcoapp/app#170

Feel free to bump it up with your own thoughts @Sealjay , @FabioTurati-NTT

[Willmish]

See example of such remediation commit here: 9d7230e

[FabioTurati-NTT]

Hi @Willmish , I agree that a remediation commit is better, because it doesn't require rewriting history, and it's also faster. If I need to do it again I'll certainly follow this approach!

[Sealjay]

Perfect - @FabioTurati-NTT you also shouldn't be required to sign these commits (although it's good practice), as this check is only applied to code submitted by non-GSF members. @seanmcilroy29 may need to check you've been invited to the GSF org

[seanmcilroy29]

@FabioTurati-NTT - I've just invited you to join

[Willmish]

Decision in #355 to close out as all devs are aware of DCO in the repo by now