[Bugs5382]

What and why

CryptOS-PKI accepts contributions under the Developer Certificate of Origin, and the CNCF IP Policy (charter section 11(b)(ii)) requires a DCO sign-off on all inbound code. This adds a check that enforces it on pull requests.

• .github/workflows/job-dco.yaml: a DCO workflow that lists the pull request's commits from the API and fails when any commit, other than a merge commit, has no Signed-off-by: line matching its author's name and email (case-insensitive). It runs on pull requests into main only, skips drafts and title or body edits, sets a 5-minute timeout, needs no checkout and uses only gh and jq from the hosted runner, so there is no third-party action to pin. If the API lists fewer commits than the pull request has (it stops at 250), the check fails rather than passing unchecked.
• .github/CONTRIBUTING.md: step 3 now asks for git commit -s, and a new Developer Certificate of Origin section says what the sign-off certifies and how to fix unsigned commits (git rebase --signoff origin/main).

The CONTRIBUTING link to the full certificate text points at the organization guide added in CryptOS-PKI/.github#6, so that one merges first. Sibling pull requests: CryptOS-PKI/api#113, CryptOS-PKI/cryptos-manager#127, CryptOS-PKI/cryptos-web#131, CryptOS-PKI/helm#23, CryptOS-PKI/docs#39.

No docs change: this is contribution tooling, with nothing user-facing on the docs site.

Refs CryptOS-PKI/.github#4

Note

The PR Body check may be red on this pull request for one reason only: it still accepts only same-repository references (Refs #N), and this change is tracked in another repository. The widened check is in #280 and isn't merged yet.

Verification

• Lint clean (actionlint 1.7.12 with shellcheck, the version CI pins)
• Tests pass (see below)
• Build succeeds (no build change)
• Documentation updated (CONTRIBUTING.md)

How this was verified

The step's script was extracted from the workflow and run locally against the GitHub API and against synthetic commit lists (14 cases, all passing):

• Real pull requests: signed commits pass (ci: accept cross-repo issue references in the PR body check #280, CryptOS-PKI/api#112); unsigned commits fail (docs: OS-specific commands and risk callouts #277, docs: show Windows and Linux/macOS versions of OS-specific commands cryptos-web#129).
• Synthetic: a matching sign-off passes, and so does one that differs only in case; a second trailer that matches passes; an unsigned merge commit is skipped. No sign-off, a sign-off by someone else, a different email, a sign-off that doesn't start its line, one unsigned commit among signed ones, and a commit list shorter than the pull request all fail.
• This pull request's own commit is signed off, so the new DCO check should pass here once the PR is ready.
• Local pre-push hooks passed, and gitleaks found nothing on the branch.

Before making the check required, note that these open pull requests into main have commits without a sign-off and would fail it until rebased with --signoff: #277, #271.

(Re-run after the widened PR-body check and the scoped secret scan merged.)

[Bugs5382]

Closing summary: adds a DCO check on pull requests that fails when a non-merge commit lacks a Signed-off-by line matching its author, and a sign-off section in CONTRIBUTING. Uses only gh and jq, runs on PRs into main, skips drafts. Tracked in CryptOS-PKI/.github#4.