dco.yml

# Require Developer Certificate of Origin (Signed-off-by) on every PR commit.
# Dependabot / GitHub Actions bot commits are exempt (automated dependency bumps).
name: DCO

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: read

jobs:
  dco:
    name: Signed-off-by
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check DCO sign-off on all PR commits
        env:
          BASE: ${{ github.event.pull_request.base.sha }}
          HEAD: ${{ github.event.pull_request.head.sha }}
          ACTOR: ${{ github.event.pull_request.user.login }}
        run: |
          set -euo pipefail
          case "$ACTOR" in
            dependabot[bot]|dependabot-preview[bot]|github-actions[bot])
              echo "Skipping DCO for bot PR author: $ACTOR"
              exit 0
              ;;
          esac
          missing=0
          while IFS= read -r sha; do
            body="$(git log -1 --format=%B "$sha")"
            author="$(git log -1 --format='%an <%ae>' "$sha")"
            # Skip bot-authored commits inside a human PR
            if printf '%s\n' "$author" | grep -qiE 'dependabot|github-actions\[bot\]'; then
              echo "SKIP bot commit $sha ($author)"
              continue
            fi
            if ! printf '%s\n' "$body" | grep -qiE '^Signed-off-by: .+ <.+>$'; then
              echo "::error::Missing Signed-off-by on commit $sha"
              git log -1 --oneline "$sha"
              missing=1
            else
              echo "OK $sha"
            fi
          done < <(git rev-list --no-merges "${BASE}..${HEAD}")
          if [ "$missing" -ne 0 ]; then
            echo "Add DCO with: git commit -s --amend (or rebase -i and re-sign). See DCO.md"
            exit 1
          fi