From 1768531c1aaf5f2b68450688d343dd178dce08e0 Mon Sep 17 00:00:00 2001
From: Rybkin <alexander.rybkin@intel.com>
Date: Thu, 3 Sep 2026 19:43:49 -0700
Subject: [PATCH] Drop the DCO sign-off requirement
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removes the gate and every document that asked for it, in one change. Half of
it would have been worse than either whole: dropping `dco.yml` alone leaves the
README, CONTRIBUTING and the PR checklist stating a rule nothing enforces, and
keeping the gate leaves a check an outside contributor cannot make green without
being told, in a repository whose whole point is to lower the entry cost.

What goes:

- `.github/workflows/dco.yml` — the `signed-off` check. It is posted by
  `github-actions`, not by a DCO GitHub App, so deleting the workflow removes
  the check itself; no ruleset on `main` requires any status check.
- `CONTRIBUTING.md` — the `### Sign your work` subsection (the DCO 1.1 text, the
  real-name rule, the `--amend -s` / `--signoff` recovery), and `-s` from the
  quickstart. `## Licence and sign-off` becomes `## Licence`, and the inbound-
  licence paragraph stays — it is the part that carries the legal weight.
- `README.md` — the `git commit -s` step, the "every commit carries a DCO
  sign-off" bullet under what CI checks, and the DCO paragraph under Licence and
  governance.
- `.github/pull_request_template.md` — the sign-off checkbox.
- `MAINTAINERS.md` — the `dco.yml` row in the CI table.

No licence hole is opened. Apache-2.0 section 5 makes a contribution
intentionally submitted for inclusion inbound-licensed by default, and
CONTRIBUTING.md says so in its own words as well. The sign-off added a
per-commit attestation, a real-name rule and a git paper trail on top of that —
not the licence.
---
 .github/pull_request_template.md |  1 -
 .github/workflows/dco.yml        | 72 -----------------------------
 CONTRIBUTING.md                  | 78 ++++----------------------------
 MAINTAINERS.md                   |  1 -
 README.md                        | 21 ++-------
 5 files changed, 13 insertions(+), 160 deletions(-)
 delete mode 100644 .github/workflows/dco.yml

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index d6c4f32..df0ab89 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -7,7 +7,6 @@
 - [ ] I checked `description` against requests a user would really type — see
       CONTRIBUTING.md.
 - [ ] `python3 tools/validate_skills.py` passes locally.
-- [ ] Every commit is signed off with `git commit -s` (DCO).
 
 <!--
 Everything else is checked by CI, so there is nothing to attest here.
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
deleted file mode 100644
index 98b3f6d..0000000
--- a/.github/workflows/dco.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-name: DCO
-
-# CONTRIBUTING.md's "Licence and sign-off" section tells every contributor that each
-# commit needs a Signed-off-by trailer. Nothing enforced it, so the requirement was documentation
-# rather than a gate. Keyless and offline, so it runs on a pull request from a fork.
-
-on:
-  pull_request:
-
-permissions:
-  contents: read
-
-# One run per ref, and a superseded run is cancelled rather than queued behind the
-# one that replaced it: a contributor pushing a fixup should not wait for the CI of
-# the commit they just replaced. Keyed on head_ref for a pull request and on ref
-# otherwise, so a pull request and the branch it targets never cancel each other.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  signed-off:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
-        with:
-          # Check out the pull request's head, not the synthetic merge commit
-          # GitHub builds for a pull_request event. That merge commit is created
-          # by GitHub, carries no Signed-off-by trailer, and is not part of what
-          # a contributor is certifying -- treating it as one made every pull
-          # request fail DCO no matter how carefully its commits were signed.
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-          persist-credentials: false
-      - name: Check every commit is signed off
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          set -euo pipefail
-          # The range has to be computable before anything is certified. `set -e` does
-          # not propagate a failure out of a process substitution, so reading the commit
-          # list straight from `< <(git rev-list ...)` made an unresolvable base commit
-          # -- a force-pushed base branch, an incomplete fetch -- print `fatal:` and pass
-          # the job with nothing checked. A legal gate that cannot see the commits must
-          # fail, not wave them through.
-          if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
-            echo "::error::base commit ${BASE_SHA} is not in this checkout, so the commits to certify cannot be listed"
-            exit 1
-          fi
-          missing=0
-          # `--no-merges`: the trailer certifies the origin of contributed code, and a
-          # merge commit contributes none -- it records that two histories were joined.
-          # Requiring one on a merge is also incompatible with stacked pull requests,
-          # where keeping a branch current means merging its base: `git merge` does not
-          # add the trailer, so every stack would have to be rebased instead, rewriting
-          # commits reviewers have already read. This is what the DCO GitHub App and the
-          # kernel's own checkpatch do. The cost is that content introduced in a merge
-          # resolution is uncertified; that content is also invisible in the per-commit
-          # diffs a reviewer reads, which is a reason to keep resolutions trivial rather
-          # than a reason to demand a trailer here.
-          commits="$(git rev-list --no-merges "${BASE_SHA}..HEAD")"
-          for sha in $commits; do
-            if ! git log -1 --format=%B "$sha" | grep -qi '^Signed-off-by: .\+ <.\+>$'; then
-              echo "::error::commit $sha is missing a 'Signed-off-by' trailer (run: git commit --amend -s)"
-              missing=1
-            fi
-          done
-          if [ "$missing" -ne 0 ]; then
-            echo "One or more commits are not signed off under the Developer Certificate of Origin (https://developercertificate.org/)." >&2
-            exit 1
-          fi
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 64134b9..b037778 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -13,7 +13,7 @@ mkdir -p skills/your-skill-name
 cp templates/SKILL.md skills/your-skill-name/SKILL.md
 # write it, then:
 python3 tools/validate_skills.py
-git commit -s -m "Add your-skill-name skill"      # -s is the DCO sign-off
+git commit -m "Add your-skill-name skill"
 ```
 
 ## `SKILL.md` frontmatter
@@ -166,80 +166,18 @@ python3 tools/run_evals.py --validate            # only if you wrote evals/evals
 
 Keyless, stdlib-only, and Python 3.11 or newer — the first and third need no network. If
 all three pass, the blocking checks left are about the repository rather than your text: the
-DCO sign-off on every commit, the workflow linters, the installer round trip, and — if you
-imported a skill from another repository — `python3 tools/sync_external.py --check`.
+workflow linters, the installer round trip, and — if you imported a skill from another
+repository — `python3 tools/sync_external.py --check`.
 
-## Licence and sign-off
+## Licence
 
-The two sections below are Intel's standard contributor text. The project name and the link
-to [LICENSE](LICENSE) are filled in; the wording and the Developer Certificate of Origin it
-quotes are unchanged, and the DCO itself may not be changed by anyone.
-
-### License
+The paragraph below is Intel's standard contributor text, with the project name and the
+link to [LICENSE](LICENSE) filled in. It is what makes a contribution inbound-licensed, and
+it is the only thing this repository asks you to agree to — there is no separate sign-off,
+no per-commit trailer, and no CLA.
 
 Intel Skills is licensed under the terms in [LICENSE](LICENSE). By contributing to the project, you agree to the license and copyright terms therein and release your contribution under these terms.
 
-### Sign your work
-
-Please use the sign-off line at the end of the patch. Your signature certifies that you wrote the patch or otherwise have the right to pass it on as an open-source patch. The rules are pretty simple: if you can certify
-the below (from [developercertificate.org](http://developercertificate.org/)):
-
-```
-Developer Certificate of Origin
-Version 1.1
-
-Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
-660 York Street, Suite 102,
-San Francisco, CA 94110 USA
-
-Everyone is permitted to copy and distribute verbatim copies of this
-license document, but changing it is not allowed.
-
-Developer's Certificate of Origin 1.1
-
-By making a contribution to this project, I certify that:
-
-(a) The contribution was created in whole or in part by me and I
-    have the right to submit it under the open source license
-    indicated in the file; or
-
-(b) The contribution is based upon previous work that, to the best
-    of my knowledge, is covered under an appropriate open source
-    license and I have the right under that license to submit that
-    work with modifications, whether created in whole or in part
-    by me, under the same open source license (unless I am
-    permitted to submit under a different license), as indicated
-    in the file; or
-
-(c) The contribution was provided directly to me by some other
-    person who certified (a), (b) or (c) and I have not modified
-    it.
-
-(d) I understand and agree that this project and the contribution
-    are public and that a record of the contribution (including all
-    personal information I submit with it, including my sign-off) is
-    maintained indefinitely and may be redistributed consistent with
-    this project or the open source license(s) involved.
-```
-
-Then you just add a line to every git commit message:
-
-    Signed-off-by: Joe Smith <joe.smith@email.com>
-
-Use your real name (sorry, no pseudonyms or anonymous contributions.)
-
-If you set your `user.name` and `user.email` git configs, you can sign your
-commit automatically with `git commit -s`.
-
-Two shortcuts for when you forget:
-
-```bash
-git commit --amend -s                # the last commit
-git rebase HEAD~N --signoff          # several
-```
-
-CI checks every non-merge commit and fails by commit SHA.
-
 ## Review
 
 CI covers form. A reviewer supplies what no keyless check can: whether an agent that
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index 2b25df1..f7385dd 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -222,7 +222,6 @@ the fix, the pin is the wrong pin.
 |---|---|---|---|
 | `validate.yml` | `validate` — `validate_skills.py`, `run_evals.py --validate`, link check | every PR | yes |
 | `validate.yml` | `install` — the installer resolves, lists, and installs from the catalog | every PR | yes |
-| `dco.yml` | sign-off on every non-merge commit, failing by commit SHA | every PR | yes |
 | `harbor-smoke.yml` | the oracle arm over every task in `tasks/` | PRs touching tasks or skills | yes |
 | `security.yml` | `actionlint`, `zizmor` | every PR | yes |
 | `codeql.yml` | code scanning, Python | PRs, push, weekly | reports |
diff --git a/README.md b/README.md
index 695c815..333edb3 100644
--- a/README.md
+++ b/README.md
@@ -186,11 +186,7 @@ favour someone does.
 
 ### 6. Open the pull request
 
-Open a pull request that clearly describes the skill, completes the PR checklist, and includes the required DCO-signed commit.
-
-```bash
-git commit -s -m "Add your-skill-name skill"      # -s is the DCO sign-off
-```
+Open a pull request that clearly describes the skill and completes the PR checklist.
 
 ## What CI checks
 
@@ -207,7 +203,6 @@ Blocking, keyless, and runnable on a fork:
   install script, a destructive delete, an instruction aimed at the agent's operator, a
   route for a secret out, or a way to switch a protection off
 - `skills.yaml` has an entry with a maintainer, and the catalog and the tree agree
-- every commit carries a DCO sign-off
 - the workflows themselves lint clean (`actionlint`, `zizmor`)
 - for a new skill: its Harbor task is solvable, oracle reward 1.0
 - for an imported skill: `skills.yaml`, `.source.json` and `NOTICE` agree, and the copy is
@@ -277,16 +272,10 @@ Apache-2.0 — see [LICENSE](LICENSE) and [NOTICE](NOTICE). A skill brought here
 another repository keeps its own licence, recorded in `skills.yaml` and in its
 `.source.json`.
 
-**DCO.** Every commit needs a `Signed-off-by` line, certifying you have the right to
-submit the contribution under Apache-2.0 — the same pattern as the Linux kernel.
-`.github/workflows/dco.yml` checks every non-merge commit on the pull request and fails
-it by commit SHA, so this is a gate rather than a request.
-
-```bash
-git commit -s -m "your message"      # sign off
-git commit --amend -s                # forgot on the last commit
-git rebase HEAD~N --signoff          # forgot on several
-```
+**Contributions.** Opening a pull request here licenses what is in it under Apache-2.0 —
+[CONTRIBUTING.md](CONTRIBUTING.md) states it, and section 5 of the licence says it for any
+contribution intentionally submitted for inclusion. Nothing else is asked: no sign-off
+trailer, no CLA, no separate agreement.
 
 **Security.** Report vulnerabilities via [SECURITY.md](SECURITY.md) or Intel PSIRT.