From f1d21b654dbc99dda31e5900a631dda1ce8a0570 Mon Sep 17 00:00:00 2001 From: willbot Date: Fri, 25 Sep 2026 12:25:26 +0200 Subject: [PATCH] ci: the DCO app checks merge-queue commits, so remove the placeholder DCO workflow .github/workflows/dco.yml ran only on merge_group and echoed a message, so the merge queue had a DCO result while the app only checked PRs. The DCO app now receives merge-queue events and posts DCO on queue commits, and the required check accepts only the app. The placeholder result was ignored and cost a runner per queue entry. Co-Authored-By: Claude Opus 5.5 Signed-off-by: willbot Signed-off-by: Will Madden --- .github/workflows/dco.yml | 21 --------------------- docs/oss/ci-pipeline.md | 2 +- 2 files changed, 1 insertion(+), 22 deletions(-) delete mode 100644 .github/workflows/dco.yml diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml deleted file mode 100644 index 2d10dc59fb34..000000000000 --- a/.github/workflows/dco.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: DCO - -# The probot DCO app validates sign-off on the pull_request event but does not -# run on merge_group, so the required "DCO" check would be absent on the merge -# queue SHA and the queue would stall. This stub posts the "DCO" check on -# merge_group; sign-off was already enforced by the app before the PR enqueued. -# The required check is matched by name ("Any source"), so the app satisfies it -# on the PR and this stub satisfies it in the queue. - -on: - merge_group: - -permissions: - contents: read - -jobs: - DCO: - name: DCO - runs-on: ubuntu-latest - steps: - - run: echo "Sign-off enforced by the DCO app on the pull request." diff --git a/docs/oss/ci-pipeline.md b/docs/oss/ci-pipeline.md index 6f6eecdf6abd..95c2d877df24 100644 --- a/docs/oss/ci-pipeline.md +++ b/docs/oss/ci-pipeline.md @@ -4,7 +4,7 @@ This page documents how the pull-request CI pipeline ([`.github/workflows/ci.yml ## What runs on a PR -`ci.yml` reports stable verification contexts including `Build`, `Type Check`, `Lint`, `Test`, `E2E Tests`, and `Integration Tests`; a small `Detect inert diff` job classifies the diff (below). Four non-required `Package Tests` shards upload native coverage blobs, `Coverage` merges and gates them while `Test Examples` runs concurrently, and a lightweight final `Test` fan-in preserves the required check name. A separate `DCO` check and the preview-publish workflow also run. `main` is governed by a repository ruleset that requires the verification contexts plus `DCO` and uses the strict "branch must be up to date" policy. Two consequences drive the whole design: +`ci.yml` reports stable verification contexts including `Build`, `Type Check`, `Lint`, `Test`, `E2E Tests`, and `Integration Tests`; a small `Detect inert diff` job classifies the diff (below). Four non-required `Package Tests` shards upload native coverage blobs, `Coverage` merges and gates them while `Test Examples` runs concurrently, and a lightweight final `Test` fan-in preserves the required check name. The [DCO app](https://github.com/apps/dco) posts a separate `DCO` check on each PR and each merge-queue commit, and the preview-publish workflow also runs. `main` is governed by a repository ruleset that requires the verification contexts plus `DCO` and uses the strict "branch must be up to date" policy. Two consequences drive the whole design: - A required status check that never reports its result **wedges the merge**. So a job that is required can never be skipped at the job level — it must always launch and report. - The ruleset is a fixed constraint. The pipeline is designed *around* it; CI changes never edit the ruleset or the set of required check names.