[Bug 552628] Can bots be added as a validated user on github for ECA purposes?

added Bugzilla legacy ~16280 labels

IIUC simply having an ECA for https://github.com/dependabot would work? Can this happen?

I think the answer is no, since a bot cannot sign the ECA(and we can't really sign it for it). But I may be wrong.

Wayne, can you provide some clarity?

-M.

(In reply to Eclipse Webmaster from comment #2)

I think the answer is no, since a bot cannot sign the ECA(and we can't
really sign it for it). But I may be wrong.

Wayne, can you provide some clarity?

A bot is not a legal entity and cannot sign a legal agreement.

This does, however, seem like a behaviour that we should try to support.

In this particular example, it looks like the bot is just providing some configuration changes. That is, the contribution itself is not particularly interesting from an intellectual property point of view, so my sense is that ownership of the content isn't an issue.

I'm thinking that this is the sort of thing that we should let project leads override the ECA checker.

(In reply to Wayne Beaton from comment #3)

I'm thinking that this is the sort of thing that we should let project leads
override the ECA checker.

+1 -- that all sounds great to me. The content of this change is just the effect of running some yarn commands. The bot is useful because the PR has the metadata collected nicely about why we should be doing the update.

Not sure the process, but some bots are already hard at work in the gerrit flow:
https://git.eclipse.org/r/#/q/owner:%22Xtext+Bot%22

Re-assigning to the Webdev team.

-M.

*** Bug 552675 has been marked as a duplicate of this bug. ***

The current plan would be allow commits from bots that we know about:
https://api.eclipse.org/bots

(In reply to Christopher Guindon from comment #8)

The current plan would be allow commits from bots that we know about:
https://api.eclipse.org/bots

I created an issue for adding dependabot[bot] support@github.com to our list of known bots account:

https://github.com/EclipseFdn/projects-bots-api/issues/1

(In reply to Christopher Guindon from comment #9)

(In reply to Christopher Guindon from comment #8)\

The current plan would be allow commits from bots that we know about:
https://api.eclipse.org/bots\
I created an issue for adding dependabot[bot] support@github.com to our list
of known bots account:

https://github.com/EclipseFdn/projects-bots-api/issues/1

I just fixed the issue.

(In reply to Mikaël Barbero from comment #10)

(In reply to Christopher Guindon from comment #9)\

(In reply to Christopher Guindon from comment #8)\

The current plan would be allow commits from bots that we know about:
https://api.eclipse.org/bots\
I created an issue for adding dependabot[bot] support@github.com to our list
of known bots account:

https://github.com/EclipseFdn/projects-bots-api/issues/1\
I just fixed the issue.

Thanks!

We are currently building a commit validation service in an effort to support github, gitlab and gerrit without duplication our business logic.

This new service will successfully validate bots using data from https://api.eclipse.org/bots

Once this new service is available, we will update our Github validation app and Gerrit ECA plugin to query this service.

Does the GH ECA validation app now successfully validate bots? (asking for bug 564139)

(In reply to Mikaël Barbero from comment #12)

Does the GH ECA validation app now successfully validate bots? (asking for
bug 564139)

No, not yet!

By Tom Jenkinson

Hi, do you have an ETA for when this would be fixed? Thanks, Tom

+1 for providing an ETA. Many projects are affected by this and while some know that you have to ignore this, it remains a moment of panic for new people who have to be calmed down and explained to ignore it.

Created attachment 283242 Tip section

(In reply to Tom Jenkinson from comment #14 (closed))

Hi, do you have an ETA for when this would be fixed? Thanks, Tom

As mentioned in my previous comment, we are currently building a commit validation service in an effort to support github, gitlab and gerrit without duplicating our business logic everywhere.

This new service will successfully validate bots using data from https://api.eclipse.org/bots

Once this new service is available, we will update our Github validation app and Gerrit ECA plugin to query this service.

^^ An update on this:

Our new Gitlab instance will be using this new service first. Once we confirm that everything is working as expected, we will update our Github Validation App to use this new service.

(In reply to arjan tijms from comment #15 (closed))

Many projects are affected by this and while some know that you have to ignore this, it remains a moment of panic for new people who have to be calmed down and explained to ignore it.

Perhaps, we could make an update to the TIPS section of the validation page that explains this workaround while we focus on migrating to our new validation service?

Screen Shot 2020-06-11 at 1.33.04 PM.png

(In reply to Christopher Guindon from comment #16)

Created attachment 283242 [details]
Tip section

(In reply to Tom Jenkinson from comment #14)\

Hi, do you have an ETA for when this would be fixed? Thanks, Tom

As mentioned in my previous comment, we are currently building a commit
validation service in an effort to support github, gitlab and gerrit without
duplicating our business logic everywhere.

So no ETA?

Perhaps, we could make an update to the TIPS section of the validation page
that explains this workaround while we focus on migrating to our new
validation service?

I looked at the picture and I am unclear what the "workaround" is.

added ECA label

removed Bugzilla label


Bugzilla Link	552628
Status	NEW
Importance	P3 normal
Reported	Nov 01, 2019 16:18 EDT
Modified	Feb 14, 2021 06:44 EDT
Depends on	496885
Blocks	564139
See also	552675

[Bug 552628] Can bots be added as a validated user on github for ECA purposes?

Description

Designs

Child items ...

Activity