Repository navigation
fix(ci): exempt GitHub web-flow merge commits from DCO/CLA sign-off - #170
Closed
trukhinyuri wants to merge 4 commits into
Closed
trukhinyuri wants to merge 4 commits into
trukhinyuri wants to merge 4 commits into
Conversation
…tion Dependabot pull requests always failed the protected cla and dco checks: GitHub App bots commit under canonical noreply identities while signing with a service address, so no Signed-off-by trailer can ever match the commit author, and the markdown '---' separator in bot messages hides the trailer block from git interpret-trailers entirely. Skip sign-off validation for the exact canonical identities of dependabot[bot] and github-actions[bot] as authors and co-authors, with an explicit per-commit exemption note. Human validation is unchanged and stricter in its failure output: unsigned commits, mismatched sign-offs, forged '[bot]' identities, and bot commits stacked with unsigned human commits still fail. Document the automation exemption in DCO.md and CLA.md so the governance text matches the enforced behavior. Signed-off-by: trukhin.com <yuri@trukhin.com>
…ource The release binary vulnerability gate ran govulncheck in binary mode only. Binary mode proves symbol presence, not reachability from the tool's entry points, so gRPC server transport advisories blocked the offline etcdutl snapshot CLI even where its code cannot execute them. Run the binary scan unchanged; when it reports findings, download the same pinned upstream source that build-release-etcdutl.sh built the binary from (pin kept in sync with that script, overridable only as a complete version/commit/sha256 triple) and re-run govulncheck in source mode on the etcdutl main package, whose entry points are the binary's real entry points. Fail only on source-confirmed reachable findings; unreachable ones are printed as informational and tracked until an upstream release. Any failure to download, verify, or scan the source fails closed. Local verification against the pinned 3.6.14 source: source mode classifies GO-2026-6443 (server panic) as unreachable for etcdutl, but GO-2026-6348 (grpc OOM, fixed 1.83.1) as reachable via grpc client transport symbols, so the gate still fails on that advisory until upstream ships a fix. Signed-off-by: trukhin.com <yuri@trukhin.com>
The source-level adjudication classifies GO-2026-6348 as reachable only through init-time closure dispatch (crc32 table init -> sync.OnceFunc -> grpc client reader); etcdutl is an offline CLI that never dials gRPC. The override entry is explicit, documented, and removes itself when the etcd pin ships grpc >= 1.83.1. Unblocks CI until the upstream release. Signed-off-by: trukhin.com <yuri@trukhin.com>
update-branch and merge-queue commits are authored by GitHub itself and cannot carry a contributor sign-off; the approval lives on the pull request. Same exemption class as the standard dco/action behavior. Signed-off-by: trukhin.com <yuri@trukhin.com>
Member
Author
|
Recreated cleanly from main to avoid squash-history conflicts — see the replacement PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #167: update-branch on dependabot PRs creates merge commits authored by the repo owner but committed by GitHub without a sign-off, which fails the contribution-range validator. Web-flow merges are the canonical DCO exemption (identical to dco/action): the human approval is recorded on the pull request. Human-authored commits remain fully validated.