search

dcoapp / app

GitHub App that enforces the Developer Certificate of Origin (DCO) on Pull Requests
https://github.com/apps/dco
ISC License
297 stars 75 forks source link

Add config option to not allow 'Set DCO to Pass' button for those with write access #119

Open jmertic opened 4 years ago

jmertic commented 4 years ago

The DCO is required for all committers and on every non-merge commit for most projects. Having the 'Set DCO to Pass' option removes the paper trail of having commits specifically signed off on.

It would be great to have a config option to have that button not enabled.

hiimbex commented 4 years ago

PRs welcome to make it disable-able, but that was a highly requested feature. It is only available for those with write access, ie people who could overwrite the check anyways.

jmertic commented 4 years ago

Is there a different path where someone with Write access could override the check? In reality, maybe Admins should have access to do that.

jmertic commented 4 years ago

Here's that PR -> https://github.com/probot/dco/pull/120

jmertic commented 4 years ago

Seeing if anyone could review my PR and merge it if applicable

jmertic commented 4 years ago

Bumping this up... @hiimbex

stale[bot] commented 4 years ago

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

jmertic commented 4 years ago

Blocked by https://github.com/probot/dco/pull/120 - @hiimbex can you review that PR now that I've made the changes requested?

hiimbex commented 4 years ago

hey I just took a look and the pr looks good. I'll try to test it out tonight.. Not sure if there's any good way to write tests for it, but definitely wanna give it a spin locally first - don't want to accidentally break things!

jmertic commented 4 years ago

Sweet - thank you! Not sure on writing tests, but let me know what could work.

jmertic commented 4 years ago

Any updates @hiimbex ?

jmertic commented 4 years ago

Checking back in on this @hiimbex - can you review and let me know if it can be merged?

jmertic commented 4 years ago

Bumping this up @hiimbex - @brianwarner also said he could help review.

stale[bot] commented 4 years ago

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

jmertic commented 4 years ago

It is - just waiting on @hiimbex and @brianwarner to help get this in :-)

stale[bot] commented 3 years ago

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

jandubois commented 1 year ago

I just ran into this as well (a team member pressed "Set DCO to Pass", assuming it would just add the missing DCO lines to their commit).

It doesn't make sense that when I configure "Do not allow bypassing the above settings" in the branch protection settings that an administrator cannot bypass other checks without changing branch protection rules again, but any developer with write access can bypass the DCO check.

And it is not visible in the PR view that the check has been bypassed, so the person doing the code review is typically unaware.