We want to add a DCO signoff for contributions. There's a bot that can check that for us.

(c) All new inbound code contributions to the CNCF shall be (i) accompanied by a Developer Certificate of Origin sign-off (https://developercertificate.org/) and (ii) made under the Apache License, Version 2.0 (available at https://www.apache.org/licenses/LICENSE-2.0), such license to be in addition to, and shall not supersede, obligations undertaken under the contribution license agreement(s) provided for in (b) above.

requirements: https://github.com/cncf/foundation/blob/main/charter.md#11-ip-policy

AC:

• bot checks commit when opening a PR
• missing sign off prevents merge