docs: Updated developer documentation with DCO and merge workflow.

* docs: Updated developer docs with workflow and DCO both requirements.

Signed-off-by: Chris Butler <chris@thebutlers.me>

* docs: Updated developer docs with workflow and DCO both requirements.

Signed-off-by: Chris Butler <chris@thebutlers.me>

.github/PULL_REQUEST_TEMPLATE.md

@@ -10,7 +10,9 @@
 - \[ \] I have updated the documentation accordingly.
 - \[ \] I have added tests to cover my changes.
 - \[ \] All new and existing tests passed.
+- \[ \] All commits are signed.
 
+<!---
 ## Pull requests instructions
 
 Please, go through these steps before you submit a PR.
@@ -37,4 +39,4 @@ Please, go through these steps before you submit a PR.
 
    e Link all other issues which the PR refers to if not closing an issue. At least one issue MUST be linked or close for a PR to be accepted.
 
-**PLEASE REMOVE THESE INSTRUCTIONS BEFORE SUBMITTING**
+-->

CONTRIBUTING.md

@@ -1,4 +1,5 @@
 ## Contributing In General
+
 Our project welcomes external contributions. If you have an itch, please feel
 free to scratch it.
 
@@ -16,7 +17,7 @@ We have also adopted [Contributor Covenant Code of Conduct](CODE_OF_CONDUCT.md).
 
 ### Proposing new features
 
-If you would like to implement a new feature, please [raise an issue](https://github.com/IBM/compliance-trestle/issues) 
+If you would like to implement a new feature, please [raise an issue](https://github.com/IBM/compliance-trestle/issues)
 labelled `enhancement` before sending a pull request so the feature can be discussed. This is to avoid
 you wasting your valuable time working on a feature that the project developers
 are not interested in accepting into the code base.
@@ -34,6 +35,21 @@ maintainers of each component affected.
 
 For a list of the maintainers, see the [MAINTAINERS.md](MAINTAINERS.md) page.
 
+### Merging and release workflow.
+
+`trestle` today is maintaing two protected workflow branches. The a trunk development branch `develop` which is the target
+for all enhancements and non critical features. `master` is used to track releases and allow for hotfixes.
+
+Each merge into `develop` will be squashed into a single commit. This can either be performed on merge or via developers
+rebasing their commits into a single commit. As `trestle` has adopted [python semantic release](python-semantic-release.readthedocs.org)
+the rebase / squash merge commit MUST follow the [angular commit style](https://github.com/angular/angular.js/blob/master/DEVELOPERS.md#-git-commit-guidelines).
+
+Merges from `develop` to `master` for release capture all of these commits for the changelog. The current objective is to
+release once per sprint (2 weeks)
+
+Hotfixes *may* be merged directly into master when critical bugs are found. Each hotfix *must* be squashed when merging
+into master and MUST only be a commit of type `fix:` in angular style.
+
 ## Legal
 
 Each source file must include a license header for the Apache
@@ -75,21 +91,24 @@ You can include this automatically when you commit a change to your
 local git repository using the following command:
 
 ```
-git commit -s
+git commit --signoff
 ```
 
+Note that DCO signoff is enforced by [DCO bot](https://github.com/probot/dco). Missing DCO's will be required to be rebased
+with a signed off commit before being accepted.
+
 ## Setup - Developing `trestle`
 
 ### Setting up `vscode` for python.
 
 - Use the following commands to setup python:
 
-~~~shell
+```shell
 python3 -m venv venv
 . ./venv/bin/activate
 # for zsh put .[dev] in quotes as below
 pip install -q -e ".[dev]" --upgrade --upgrade-strategy eager
-~~~
+```
 
 - Install vscode plugin `Python extension for Visual Studio Code`
 
@@ -115,31 +134,30 @@ pytest fixtures are available to allow provision of common functionality.  See c
 
 ### Code style and formating
 
-`trestle` uses [yapf](<https://github.com/google/yapf>) for code formatting and [flake8](<https://flake8.pycqa.org/en/latest/>) for code styling.  It also uses [pre-commit](<https://pre-commit.com/>) hooks that are integrated into the development process and the CI. When you run `make develop` you are ensuring that the pre-commit hooks are installed and updated to their latest versions for this repository. This ensures that all delivered code has been properly formatted
+`trestle` uses [yapf](https://github.com/google/yapf) for code formatting and [flake8](https://flake8.pycqa.org/en/latest/) for code styling.  It also uses [pre-commit](https://pre-commit.com/) hooks that are integrated into the development process and the CI. When you run `make develop` you are ensuring that the pre-commit hooks are installed and updated to their latest versions for this repository. This ensures that all delivered code has been properly formatted
 and passes the linter rules.  See the [pre-commit configuration file](<>)./.pre-commit-config.yaml) for details on
 `yapf` and `flake8` configurations.
 
 Since `yapf` and `flake8` are installed as part of the `pre-commit` hooks, running `yapf` and `flake8`
 manually must be done through `pre-commit`.  See examples below:
 
-~~~shell
+```shell
 make code-format
 make code-lint
-~~~
+```
 
 ...will run `yapf` and `flake8` on the entire repo and is equivalent to:
 
-~~~shell
+```shell
 pre-commit run yapf --all-files
 pre-commit run flake8 --all-files
-~~~
+```
 
 ...and when looking to limit execution to a subset of files do similar to:
 
-~~~shell
+```shell
 pre-commit run yapf --files trestle/*
 pre-commit run flake8 --files trestle/*
-~~~
+```
 
 Note that in both of these cases autogenerated files under `trestle/oscal` are excluded. Note that for IDE support `setup.cfg` maintains a cache of `flake8` configuration.
-