From b665ed6078367a287e77c2586a2317da894a5c69 Mon Sep 17 00:00:00 2001 From: Demetris Gerogiannis <8920360+dgerog@users.noreply.github.com> Date: Tue, 14 Jul 2026 13:49:38 +0300 Subject: [PATCH] chore(governance): replace CLA with DCO, add NOTICE and third-party license policy External contributions no longer require signing a CLA. The Developer Certificate of Origin v1.1 (DCO.md) replaces CLA.md: contributors sign off commits with `git commit -s`, keep their copyright, and license their work inbound = outbound under Apache-2.0. A dco.yml workflow enforces the Signed-off-by trailer on every PR (merge commits exempt). Also adds the Apache-2.0 NOTICE file and an explicit inbound license policy in CONTRIBUTING.md (permissive-only for vendored code; no GPL/AGPL/SSPL/BSL). Matches the governance switch already merged in humanbound/humanbound and humanbound/humanbound-firewall. Co-Authored-By: Claude Fable 5 Signed-off-by: Demetris Gerogiannis <8920360+dgerog@users.noreply.github.com> --- .github/PULL_REQUEST_TEMPLATE.md | 2 +- .github/workflows/dco.yml | 42 ++++++++ CHANGELOG.md | 14 +++ CLA.md | 172 ------------------------------- CONTRIBUTING.md | 37 ++++++- DCO.md | 68 ++++++++++++ NOTICE | 5 + README.md | 4 +- 8 files changed, 164 insertions(+), 180 deletions(-) create mode 100644 .github/workflows/dco.yml delete mode 100644 CLA.md create mode 100644 DCO.md create mode 100644 NOTICE diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index a99f3c6..dfaa3b1 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -24,7 +24,7 @@ - [ ] Plugin tests pass (`./tests/run-tests.sh` inside the affected plugin) - [ ] Interactive flow verified manually in **both** Claude Code and Cursor - [ ] `CHANGELOG.md` updated under `[Unreleased]` with plugin name prefix -- [ ] [CLA](https://github.com/humanbound/plugins/blob/main/CLA.md) signed (the CLAAssistant bot will prompt you on first PR) +- [ ] All commits are signed off (`git commit -s`) — see [DCO.md](https://github.com/humanbound/plugins/blob/main/DCO.md) ## Linked issue(s) diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml new file mode 100644 index 0000000..f13cbc3 --- /dev/null +++ b/.github/workflows/dco.yml @@ -0,0 +1,42 @@ +name: DCO + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + pull-requests: read + +jobs: + dco: + name: Signed-off-by check + runs-on: ubuntu-latest + steps: + - name: Verify every commit carries a Signed-off-by trailer + uses: actions/github-script@v7 + with: + script: | + const commits = await github.paginate(github.rest.pulls.listCommits, { + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: context.payload.pull_request.number, + }); + // Merge commits are bot-generated and exempt, matching the + // behavior of the standard probot DCO app. + const missing = commits + .filter(c => c.parents.length < 2) + .filter(c => !/^Signed-off-by: .+ <.+@.+>$/m.test(c.commit.message)); + if (missing.length === 0) { + core.info(`All ${commits.length} commit(s) are signed off.`); + return; + } + const list = missing + .map(c => ` ${c.sha.slice(0, 7)} ${c.commit.message.split('\n')[0]}`) + .join('\n'); + core.setFailed( + `${missing.length} commit(s) are missing a Signed-off-by trailer (see DCO.md):\n` + + `${list}\n\n` + + `Fix with "git commit --amend -s" (single commit) or ` + + `"git rebase --signoff origin/main" (whole branch), then force-push.` + ); diff --git a/CHANGELOG.md b/CHANGELOG.md index d5dd118..7b9c811 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,20 @@ and each plugin adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0. only via `/humanbound-test:resume ` (the polling logic moved into a dedicated "Resume path" section in `dispatching-hb-tests/SKILL.md` — no behavior change for resume itself). +- **Contribution policy: CLA replaced by DCO** (repo-wide). External + contributions no longer require signing the Humanbound Contributor + License Agreement. Contributions are now accepted under the Developer + Certificate of Origin v1.1 (see `DCO.md`) — sign commits with + `git commit -s`. Contributors keep their copyright; contributions are + licensed inbound = outbound under Apache-2.0. `CLA.md` is removed and a + `dco.yml` workflow now checks `Signed-off-by` trailers on every pull + request. +- `CONTRIBUTING.md` gains an explicit third-party license policy: vendored + code must be permissively licensed (Apache-2.0/MIT/BSD/ISC); GPL, AGPL, + SSPL, and BSL code cannot be accepted. + +### Added +- `NOTICE` file per Apache-2.0 section 4(d). ## [humanbound-test 0.1.0] — 2026-05-12 diff --git a/CLA.md b/CLA.md deleted file mode 100644 index ce26a67..0000000 --- a/CLA.md +++ /dev/null @@ -1,172 +0,0 @@ -# Humanbound Contributor License Agreement (v1.0) - -Thank you for your interest in contributing to `humanbound` (the -"Project"), maintained by **AI and Me Single-Member Private Company** (also -known as "Humanbound"), a private company incorporated in Greece (GEMI -No. 163102829000; Tax ID 801775352; EU VAT EL801775352; with registered seat at -11 Karaoli & Dimitriou Street, 45221 Ioannina, Greece), hereinafter referred to -as "Humanbound" or "the Company." - -This Contributor License Agreement ("Agreement") clarifies the intellectual- -property rights granted with contributions from any person or entity. It is -adapted from the Apache Software Foundation Individual Contributor License -Agreement v2.2 (see [apache.org/licenses/icla.pdf](https://www.apache.org/licenses/icla.pdf)). - -You accept and agree to the following terms and conditions for Your present -and future Contributions submitted to Humanbound. Except for the license -granted herein to Humanbound and recipients of software distributed by -Humanbound, You reserve all right, title, and interest in and to Your -Contributions. - -## 1. Definitions - -**"You"** (or **"Your"**) shall mean the copyright owner or legal entity -authorized by the copyright owner that is making this Agreement with -Humanbound. For legal entities, the entity making a Contribution and all -other entities that control, are controlled by, or are under common control -with that entity are considered to be a single Contributor. For the purposes -of this definition, "control" means (i) the power, direct or indirect, to -cause the direction or management of such entity, whether by contract or -otherwise, or (ii) ownership of fifty percent (50%) or more of the -outstanding shares, or (iii) beneficial ownership of such entity. - -**"Contribution"** shall mean any original work of authorship, including any -modifications or additions to an existing work, that is intentionally -submitted by You to Humanbound for inclusion in, or documentation of, any of -the products owned or managed by Humanbound (the "Work"). For the purposes -of this definition, "submitted" means any form of electronic, verbal, or -written communication sent to Humanbound or its representatives, including -but not limited to communication on electronic mailing lists, source code -control systems, and issue tracking systems that are managed by, or on -behalf of, Humanbound for the purpose of discussing and improving the Work, -but excluding communication that is conspicuously marked or otherwise -designated in writing by You as "Not a Contribution." - -## 2. Grant of Copyright License - -Subject to the terms and conditions of this Agreement, You hereby grant to -Humanbound and to recipients of software distributed by Humanbound a -perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable -copyright license to reproduce, prepare derivative works of, publicly -display, publicly perform, sublicense, and distribute Your Contributions and -such derivative works. - -## 3. Grant of Patent License - -Subject to the terms and conditions of this Agreement, You hereby grant to -Humanbound and to recipients of software distributed by Humanbound a -perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable -(except as stated in this section) patent license to make, have made, use, -offer to sell, sell, import, and otherwise transfer the Work, where such -license applies only to those patent claims licensable by You that are -necessarily infringed by Your Contribution(s) alone or by combination of -Your Contribution(s) with the Work to which such Contribution(s) was -submitted. If any entity institutes patent litigation against You or any -other entity (including a cross-claim or counterclaim in a lawsuit) -alleging that your Contribution, or the Work to which you have contributed, -constitutes direct or contributory patent infringement, then any patent -licenses granted to that entity under this Agreement for that Contribution -or Work shall terminate as of the date such litigation is filed. - -## 4. You represent - -4.1 You represent that you are legally entitled to grant the above license. -If your employer(s) has rights to intellectual property that you create that -includes your Contributions, you represent that you have received permission -to make Contributions on behalf of that employer, that your employer has -waived such rights for your Contributions to Humanbound, or that your -employer has executed a separate Corporate CLA with Humanbound. - -4.2 You represent that each of Your Contributions is Your original creation -(see section 7 for submissions on behalf of others). - -4.3 You represent that Your Contribution submissions include complete -details of any third-party license or other restriction (including, but not -limited to, related patents and trademarks) of which you are personally -aware and which are associated with any part of Your Contributions. - -## 5. Support - -You are not expected to provide support for Your Contributions, except to -the extent You desire to provide support. You may provide support for free, -for a fee, or not at all. Unless required by applicable law or agreed to in -writing, You provide Your Contributions on an "AS IS" BASIS, WITHOUT -WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, -without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, -MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. - -## 6. Notification - -Should You wish to submit work that is not Your original creation, You may -submit it to Humanbound separately from any Contribution, identifying the -complete details of its source and of any license or other restriction -(including, but not limited to, related patents, trademarks, and license -agreements) of which you are personally aware, and conspicuously marking -the work as "Submitted on behalf of a third-party: [named here]". - -## 7. Change of Circumstances - -You agree to notify Humanbound of any facts or circumstances of which you -become aware that would make these representations inaccurate in any -respect. - -## 8. Project Stewardship and Attribution - -**8.1 Project Evolution.** Humanbound is responsible for the long-term -stewardship of the Project, which sometimes requires operational decisions -about how, where, and under what terms it is distributed. Your Contributions -are subject to those decisions. Specifically, Humanbound may at its -discretion: - - (a) change the repository's visibility (public, private, or archived) or - its hosting location; - (b) release future versions of the Project under a different license, - including a proprietary or source-available license; - (c) integrate Your Contributions into commercial products, managed - services, or hosted offerings; - (d) discontinue public distribution of the Project; - (e) transfer this Agreement and the rights granted hereunder to a - successor entity (for example, in the event of an acquisition or - corporate restructuring). - -These operational choices do not affect Your right to use Your own -Contributions elsewhere, nor do they retroactively change the license of any -already-released version: any public Apache-2.0 release remains permanently -available under Apache-2.0. Humanbound's flexibility applies to the Project's -future evolution and to Humanbound's own commercial use of the contributed -work. - -**8.2 Attribution.** Humanbound will preserve Your authorship of -Contributions in the Project's version control history (e.g., git commit -metadata), and welcomes You to reference Your Contributions in personal -portfolios, talks, and publications. Beyond git history, Humanbound is not -obliged to attribute You in product interfaces, marketing, or documentation, -though it may do so as a matter of good practice. - -**8.3 Moral Rights.** The grants in Sections 2 and 3 are intended to give -Humanbound the commercial flexibility described above. To make those grants -effective across jurisdictions, You agree not to invoke any moral rights You -may retain (such as rights of integrity or attribution beyond git history) -in a way that would restrict Humanbound's use of Your Contributions. Where -applicable law does not permit a full waiver, this clause operates as a -covenant not to sue. - -## Corporate CLA - -If you are contributing on behalf of your employer or another legal entity, -a Corporate Contributor License Agreement (CCLA) is available by contacting -[legal@humanbound.ai](mailto:legal@humanbound.ai). The CCLA allows an -authorized signer to cover all contributions from a named list of -individuals. - -## Governing Law - -This Agreement is governed by the laws of Greece. Any disputes arising out -of or in connection with this Agreement shall be subject to the exclusive -jurisdiction of the Courts of Athens. - ---- - -*Adapted from the Apache Software Foundation Individual Contributor License -Agreement v2.2 with permission. The Humanbound CLA is made available under -the same terms as the original.* diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 83b7b71..89a2991 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -48,12 +48,39 @@ Bugs, feature requests, and questions all live in **Do not file security issues publicly.** See [SECURITY.md](./SECURITY.md). -## Contributor License Agreement (CLA) — required +## Developer Certificate of Origin (DCO) — required -Every external contribution must be covered by the -[Humanbound Contributor License Agreement](./CLA.md). The first time you -open a pull request, the CLAAssistant bot will comment with a one-line -instruction to sign. +This project does **not** use a CLA. Contributions are accepted under the +[Developer Certificate of Origin](./DCO.md) — the same lightweight mechanism +used by the Linux kernel, CNCF projects, and GitLab. You keep the copyright +to your work; it is licensed inbound = outbound under +[Apache-2.0](./LICENSE), exactly like the rest of the codebase. + +There is nothing to sign — just add the `-s` flag when committing: + +```bash +git commit -s -m "your message" +``` + +CI checks that every commit in a pull request carries the resulting +`Signed-off-by` trailer. Forgot one? `git commit --amend -s` (or +`git rebase --signoff main` for a whole branch) and force-push. + +## Third-party code and licenses + +To keep the repository safely redistributable under Apache-2.0: + +- **Code copied or vendored into this repository** (scripts, snippets, + assets) must be under a permissive license: Apache-2.0, MIT, BSD (2- or + 3-clause), or ISC. Include the upstream copyright notice and license + text, and mention the origin in your PR description. +- **New dependencies a plugin pulls in at runtime** must be permissively + licensed as above; weak-copyleft dependencies (MPL-2.0, LGPL) are + acceptable only unmodified and need maintainer sign-off. +- **GPL, AGPL, SSPL, or BSL-licensed code cannot be accepted** in any form + (vendored, copied, or as a dependency). + +If you're unsure about a license, ask in the PR before writing code. ## Change workflow diff --git a/DCO.md b/DCO.md new file mode 100644 index 0000000..1c740fa --- /dev/null +++ b/DCO.md @@ -0,0 +1,68 @@ +# Developer Certificate of Origin + +Contributions to this project are accepted under the +[Developer Certificate of Origin v1.1](https://developercertificate.org/) +(DCO), the same mechanism used by the Linux kernel, CNCF projects, and +GitLab. There is nothing to sign and no account to create: you certify the +DCO by adding a `Signed-off-by` line to each commit, which `git` does for +you with the `-s` flag: + +```bash +git commit -s -m "fix: handle empty provider list" +``` + +That appends a trailer with the name and email from your git config: + +``` +Signed-off-by: Jane Developer +``` + +By signing off, you certify the statements below — in short, that you wrote +the change or otherwise have the right to submit it under the project's +open-source license ([Apache-2.0](./LICENSE)). Contributions are licensed +inbound = outbound: you keep the copyright to your work, and it is licensed +to the project and everyone else under Apache-2.0, exactly like the rest of +the codebase. + +If you forget to sign off, amend the commit (`git commit --amend -s`) or +sign off a whole branch (`git rebase --signoff main`) and force-push; the +DCO check on the pull request will re-run automatically. + +The full text of the Developer Certificate of Origin v1.1 follows, verbatim: + +``` +Developer Certificate of Origin +Version 1.1 + +Copyright (C) 2004, 2006 The Linux Foundation and its contributors. + +Everyone is permitted to copy and distribute verbatim copies of this +license document, but changing it is not allowed. + + +Developer's Certificate of Origin 1.1 + +By making a contribution to this project, I certify that: + +(a) The contribution was created in whole or in part by me and I + have the right to submit it under the open source license + indicated in the file; or + +(b) The contribution is based upon previous work that, to the best + of my knowledge, is covered under an appropriate open source + license and I have the right under that license to submit that + work with modifications, whether created in whole or in part + by me, under the same open source license (unless I am + permitted to submit under a different license), as indicated + in the file; or + +(c) The contribution was provided directly to me by some other + person who certified (a), (b) or (c) and I have not modified + it. + +(d) I understand and agree that this project and the contribution + are public and that a record of the contribution (including all + personal information I submit with it, including my sign-off) is + maintained indefinitely and may be redistributed consistent with + this project or the open source license(s) involved. +``` diff --git a/NOTICE b/NOTICE new file mode 100644 index 0000000..9f64aa8 --- /dev/null +++ b/NOTICE @@ -0,0 +1,5 @@ +humanbound plugins +Copyright 2024-2026 AI and Me Single-Member Private Company (Humanbound) + +This product includes software developed at Humanbound +(https://humanbound.ai/). diff --git a/README.md b/README.md index 8cb0551..8497d2b 100644 --- a/README.md +++ b/README.md @@ -94,8 +94,8 @@ Different hook models, equivalent posture. Contributions are welcome — both bug fixes for the existing plugin and proposals for new plugins. See [CONTRIBUTING.md](./CONTRIBUTING.md) for the -dev loop, plugin layout conventions, and the CLA requirement (see -[CLA.md](./CLA.md)). +dev loop, plugin layout conventions, and the DCO sign-off requirement (see +[DCO.md](./DCO.md)). - 🐛 [Report a bug](https://github.com/humanbound/plugins/issues/new/choose) - 💡 [Request a feature](https://github.com/humanbound/plugins/issues/new/choose)