Renovate: Proposal: new option for Signed-off-by / DCO or `commitBody`

[tunnckoCore]

Hi!

I'm willing to add DCO required check for the @tunnckoCore repos, and so, probably Renovate won't work well with that.

I'm looking for current options, but the only one that i think may be worked around is commitMessage? For example adding new line and manual Signed-off-by: tag? I'm almost sure it will work. But it would be good to have separate option for that, for example, signoff: true, so it will add that tag line itself.

Or probably adding commitBody option would work too.

[rarkins]

You should be able to work around this by customising the commitMessage. It's just a string so should be fine with some line returns and extra text added

[tunnckoCore]

Ye, i'm trying it now. We'll see after few hours and will report back.

[rarkins]

I don't mind adding a commitBody field soon though

[tunnckoCore]

Anyway, i'm more for signoff option (i specially naming it that way, because it's the same in git). It will do that, instead everyone to do that manually through the commitMessage. And it will be easier for bigger projects to integrate Renovate without thinking how both things (DCO signing and Renovate) could work.

[rarkins]

I preferred commitBody as it seemed more generic. Isn't this DCO essentially still "proprietary" or is it truly and one and only "standard" for signing off commits?

[rarkins]

I see that the -s option (short for --signoff) is indeed "standardised" as part of git CLI, so a commitSignoff in Renovate sounds OK.

[tunnckoCore]

Isn't this DCO essentially still "proprietary" or is it truly and one and only "standard" for signing off commits?

I think it's meant to be standard. It has site and is used by The Linux and other big names, so...

But yea, commitSignoff sounds good too.

[tunnckoCore]

So, yea, problem with using the commitMessage option. Because it lowercases the whole message, but the tag needs to be with capital "S" in Singed-off-by

See tunnckoCore/parse-function#49@5782d0aa message.

So yea, best would be to have commitSignoff true/false, which adds bot's "Sign off". And probably, not sure, should add some meaningful email that can review from time to time, don't know.

[tunnckoCore]

opened an issue at Probot's DCO app https://github.com/probot/dco/issues/29 , so lowercasing the message may not be a problem.

[rarkins]

We can fix it at this end too. The lowercasing is because that's the correct way for semantic commits. However we only should need to lowercase the first line and leave the rest as they are.

[tunnckoCore]

Absolutely. Great, i'll wait a bit.

[rarkins]

@olstenlarck I'm revisiting this one. Should the renovate bot sign off on commits as "itself"?

perhaps:

• Configure commitSignOffMessage message on server (bot owner needs to configure it, it's blank by default or set to some "alert")
• Users like yourself flip commitSignOff from false to true in renovate.json ?

[tunnckoCore]

Should the renovate bot sign off on commits as "itself"?

Mmm. Probably, it's okey for me and for the idea of DCO required. But also should be configurable, cuz Renovate is a bot, owned by someone ;d

[rarkins]

So the signoff message

• should have a default value
• should be configurable by bot admin
• should be able to be overridden by the repo owner?

And is there any way Renovate could "detect" DCO use in a repo?

[tunnckoCore]

Yup.

And is there any way Renovate could "detect" DCO use in a repo?

Something similar of how detecting semantic commits. Or str.includes('Signed-off-by:')?

[rarkins]

OK, so I'll do like semantic commits then. Default will be "null" which means autodetect. If we see any of the last 10 (?) commits use DCO then we'll enable it. That way users can also choose to (a) configure it always-on, or (b) configure it always-off. Do you have an example public repo I can use when testing?

[tunnckoCore]

Sounds good, yea. Probably this one is good tunnckoCore/rollup-config-tunnckocore.

[rarkins]

@olstenlarck this is now implemented using a preset. You can add the preset ":gitSignOff" to your config's extends array to have the Signed-off-by git signoff added. It will add the "gitAuthor" value, which for the GitHub App is set to "Renovate Bot [e-mail]".

[tunnckoCore]

Sweeet! Okey, I will update my preset :)