ci: migrate DCO to GitHub App + skip lint/test on docs-only PRs#161
Merged
Conversation
- Replace the in-repo tim-actions/dco job with the dcoapp GitHub App (config in .github/dco.yml): exempts org members and lets contributors fix a missing sign-off with a remediation commit instead of a rebase, which also clears unsigned bot commits (autofix.ci) that deadlocked DCO. - Gate the required lint + test jobs on a new `code` paths-filter output so docs-only PRs skip them; a skipped required check counts as a pass, so those PRs stay mergeable without running the full toolchain. - CONTRIBUTING.md: document remediation-without-rebase. - PR template: promote the sign-off reminder from a hidden comment to a visible checklist item. - pre-commit: tell codespell `thirdParty` (a dcoapp config key) is not a typo. Signed-off-by: Sean Mauk <seanmauk@krakennetworks.com>
krakennetworks
approved these changes
Jun 25, 2026
This was referenced Jun 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two contributor-friction fixes to CI, motivated by recurring
DCOfailures (e.g. #159) and full lint/test cycles running on docs-only PRs.1. DCO → dcoapp GitHub App
Replaces the in-repo
tim-actions/dcojob with the dcoapp GitHub App (config in.github/dco.yml):require.members: false— org members' commits no longer need a sign-off line.allowRemediationCommits— a missing sign-off is fixed by pushing one remediation commit (the app comments the exact command), instead of agit rebase --signoffhistory rewrite.thirdParty: truelets a maintainer sign off on someone else's behalf — including unsigned bot commits (autofix.ci) that previously deadlocked DCO even after a human signed off.2. Skip
lint+teston docs-only PRsAdds a
codeoutput to the existingchangespaths-filter (**minus*.md/docs/**/mkdocs.yml/LICENSE) and gates the two required jobs on it. A skipped required check counts as a pass, so docs-only PRs stay mergeable without running the full toolchain. Negation-only design means the worst-case failure mode is "runs anyway," never "wrongly skips code."Changes
.github/workflows/ci.yml—codefilter + gatelint/test; removedcojob..github/dco.yml— new dcoapp config.CONTRIBUTING.md— remediation-without-rebase guidance..github/PULL_REQUEST_TEMPLATE.md— sign-off reminder promoted from hidden comment to visible checklist item..pre-commit-config.yaml— codespell ignore for thethirdPartyconfig key.Note on ruff
No ruff changes needed —
autofix.yml,.pre-commit-config.yaml, andlintalready share ruff 0.15.12 viauv.lock, so autofix.ci already auto-applies + pushes style fixes. The real blocker was the unsigned-bot-commit DCO deadlock, which #1 resolves.Testing
uv run pytestpasses — n/a, CI-only change (no Python touched)uv run ruff check src/ tests/passes — n/a, no Python toucheduv run pyrightpasses — n/a, no Python touched🤖 Generated with Claude Code