Required DCO verification on pull requests

[peternied]

Recently DCO check was added to the .github template for OpenSearch-Project, this should be rolled out into all of the existing repositories to ensure that DCO checks are done on any incoming pull requests.

• Ensure DCO Workflow Check #21
• Ensure DCO Workflow Check alerting#190
• Ensure DCO Workflow Check alerting-dashboards-plugin#120
• Ensure DCO Workflow Check anomaly-detection#256
• Ensure DCO Workflow Check anomaly-detection-dashboards-plugin#98
• Ensure DCO Workflow Check asynchronous-search#47
• Ensure DCO Workflow Check common-utils#76
• Ensure DCO Workflow Check dashboards-notebooks#86
• Ensure DCO Workflow Check reporting#169
• Ensure DCO Workflow Check dashboards-visualizations#28
• Ensure DCO Workflow Check data-prepper#326
• Ensure DCO Workflow Check documentation-website#190
• Ensure DCO Workflow Check index-management#156
• Ensure DCO Workflow Check index-management-dashboards-plugin#99
• Ensure DCO Workflow Check job-scheduler#67
• Ensure DCO Workflow Check k-NN#107
• Ensure DCO Workflow Check logstash-output-opensearch#85
• Ensure DCO Workflow Check notifications#333
• Ensure DCO Workflow Check OpenSearch#1318
• Ensure DCO Workflow Check opensearch-build#658
• Ensure DCO Workflow Check opensearch-cli#28
• Ensure DCO Workflow Check OpenSearch-Dashboards#834
• Ensure DCO Workflow Check opensearch-devops#74
• Ensure DCO Workflow Check opensearch-plugins#88
• Ensure DCO Workflow Check performance-analyzer#68
• Ensure DCO Workflow Check performance-analyzer-rca#78
• Ensure DCO Workflow Check perftop#21
• Ensure DCO Workflow Check piped-processing-language#8
• Ensure DCO Workflow Check project-website#334
• Ensure DCO Workflow Check security#1463
• Ensure DCO Workflow Check security-dashboards-plugin#835
• Ensure DCO Workflow Check sql#223
• Ensure DCO Workflow Check observability#121
• Ensure DCO Workflow Check opensearch-plugin-template-java#14
• Ensure DCO Workflow Check #22
• Ensure DCO Workflow Check geospatial#6
• Ensure DCO Workflow Check cross-cluster-replication#201
• Ensure DCO Workflow Check opensearch-go#71
• Ensure DCO Workflow Check opensearch-java#39
• Ensure DCO Workflow Check opensearch-py#80
• Ensure DCO Workflow Check opensearch-js#180
• Ensure DCO Workflow Check helm-charts#76
• Ensure DCO Workflow Check ansible-playbook#4
• Ensure DCO Workflow Check opensearch-dashboards-functional-test#6
• Ensure DCO Workflow Check opensearch-dashboards-test-library#3
• Ensure DCO Workflow Check opensearch-ci#19
• Ensure DCO Workflow Check helm-charts#100

[peternied]

To fan this issue out to all repos, this is the command:

meta exec "gh issue create --label enhancement --title 'Ensure DCO Check' --body-file ../issue.md"

issue.md:

A Developer Certificate of Origin is required on commits in the OpenSearch-Project.

See doc.yml for an example workflow. Ensure CONTRIBUTING.md to has a section on the DCO per the project template.

• DCO Check Workflow
• CONTRIBUTING.md DCO Section

@dblock mind reviewing this before I pull the trigger?

[dblock]

You'll want the child issue linked to this one (or another parent) that can be updated easily in case instructions need to evolve, and be a little more prescriptive scoped for the repo in which the issue is opened. Plus DCO.yml should not be DOC.yml ;)

Coming from https://github.com/opensearch-project/project-meta/issues/17.

A Developer Certificate ... (I would drop not all repositories ...).

See [dco.yml](https://github.com/opensearch-project/.github/blob/main/workflow/dco.yml) for an example. Ensure that CONTRIBUTING has a section ...

- [ ] ... 

When you run meta it will execute in a subdirectory of the project, so you'll need to make issue.md and reference it as ../issue.md.

[vchrombie]

coming from opensearch-project/opensearch-py#80 (comment)

in short, the dco bot can be configured at the organization level and it doesn't need any github action workflows.

I just wanted to comment about the other options available. Please feel free to proceed with whatever option the organisation maintainers prefer.
Thanks.

[peternied]

Initially we considered using that DCO bot and choose not to due to its requirement to access private repositories.

This option seems like the best path forward to stop the manually inspection ever commit in a pull requests

[dbbaughe]

@peternied Instead of having everyone go and create duplicate github workflows across all the repositories, do you want to create workflow template in the .github repository and then all repos can reuse that workflow without having to duplicate?

https://docs.github.com/en/actions/learn-github-actions/creating-workflow-templates
https://docs.github.com/en/actions/learn-github-actions/reusing-workflows

This probably applies to quite a few different workflows we have, we can take everything common in the different repositories, define them in a single place (.github repo) and reuse so the actual workflow definition if needed to be changed can be done in one place.

[peternied]

@dbbaughe Looking atcalling-a-reusable-workflow would look something like this with already checked in version of this workflow:

jobs:
  dco-check:
    uses: opensearch-project/.github/workflows/doc.yml@main

Could you try that out and see if we should change the instructions on the issues?

[dbbaughe]

@peternied Based on the creating-workflow-templates part it seems the reusable templates must be in a directory called workflow-templates along w/ some json properties file before they can be used.

[peternied]

I'll drill in more next week, great suggestion

[peternied]

@dbbaughe I've attempted to follow the instructions with my own organization, but haven't been able to get it to work. If you can get it to work I would be happy to update the instructions on all the issues.

In either case, each team will still need to create a workflow and update its CONTRIBUTING.md