feat(tcfeed): sign off every commit so a DCO check cannot block the ask - #132
Merged
Conversation
Two of the open requests are stuck on a failed DCO check — Saxy/Tellstone #44 from today's batch and inspektor-gadget #5748 from an earlier one. Neither is a disagreement about the change. Both are a missing trailer. DCO is unusual among the checks this meets in that it cannot be fixed forward: the bot reads every commit already on the branch, so the only remedy is rewriting the commit and force-pushing. That is a poor thing to be doing on somebody else's review, and it is entirely avoidable by writing the trailer the first time. All three commit sites now sign: openPr the initial request --signoff pushFix a remedy after a red check --signoff refreshOne the pack update contents API, so by hand The third is the one worth spelling out. It never runs git, so it had no way to pick the trailer up, and left alone it would push an unsigned commit onto a request that had already satisfied DCO — breaking a green check on our own initiative. signoff() reads git's configuration so it agrees with what the other two sign, and falls back to the account behind the token, which is who the API records as committer anyway. It returns empty rather than guessing when only half an identity is available. A trailer with no address looks right and fails the check regardless, and a silent failure there is worse than none. Verified the resolved trailer is "Signed-off-by: Anthony Ettinger <anthony@chovy.com>", which is the author DCO named in its report on #44. This does not fix the two already blocked. Those need their branches rewritten, which is a force-push, and it is not mine to do unasked. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ThreatCrush Security Scan67 finding(s) HIGH/CRITICAL: 11 | MEDIUM: 55 | LOW: 1
…and 17 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two open outreach requests are stuck on a failed DCO check — Saxy/Tellstone#44 from today's batch and inspektor-gadget#5748 from an earlier one. Neither is a disagreement about the change; both are a missing
Signed-off-bytrailer.DCO is unusual among the checks tcfeed meets in that it cannot be fixed forward. The bot reads every commit already on the branch, so the only remedy is rewriting the commit and force-pushing — a poor thing to be doing on somebody else's review, and entirely avoidable by writing the trailer the first time.
What changed
All three commit sites now sign:
openPr--signoffpushFix--signoffrefreshOneThe third is the one worth spelling out. It never runs git, so it had no way to pick the trailer up — and left alone it would push an unsigned commit onto a request that had already satisfied DCO, breaking a green check on our own initiative.
signoff()reads git's configuration so it agrees with what the other two sign, and falls back to the account behind the token, which is who the API records as committer anyway. It returns empty rather than guessing when only half an identity is available: a trailer with no address looks right and fails the check regardless, and a silent failure there is worse than none.Verification
Resolved trailer is
Signed-off-by: Anthony Ettinger <anthony@chovy.com>— the author DCO named in its report on #44. Confirmed cached on the second call.Not covered
This does not fix the two already blocked. Those need their branches rewritten, which is a force-push, and it is not something to do unasked.
🤖 Generated with Claude Code