Pulumi up fails on main

[jku]

Currently "pulumi up" (github-sync-main-sigstore) fails consistently on main. See example:
https://github.com/sigstore/community/actions/runs/7703455029/job/20993867318

The failure is

422 Commit signoff is enforced by the organization and cannot be disabled []

• it's currently unclear why this started to suddenly fail between d9bdb66 and a388f3f : the config does not actually try to set webCommitSignoffRequired anywhere...
• Bob tried to fix this by explicitly setting all repositories webCommitSignoffRequired to true in5a77a4b : this did not help

[cpanato]

I will take a look on that

[jku]

Maybe related integrations/terraform-provider-github#2077

I can't figure out the versions of software we run but terraform-provider-github 5.43 mentioned in that issue is part of pulumi-github 5.24 which was released Jan 5 -- this seems to be at least close to our failure timeline.

[jku]

Based on github-sync commits the differences between last working and first failing runs is

• Bump github.com/pulumi/pulumi-github/sdk/v5 from 5.24.0 to 5.25.0
• Bump github.com/pulumi/pulumi/sdk/v3 from 3.100.0 to 3.101.1

This does not exactly match the linked issue but is likely related.

[cpanato]

fixed.
We need to disable the org policy for commit signoff and apply that for the repos we want, as we already did looks like.
I've disable that setting now.
cc @bobcallaway

and retrigger the pipeline https://github.com/sigstore/community/actions/runs/7703455029

[haydentherapper]

Thanks yall for looking into this!