|
| 1 | +name: DCO |
| 2 | +# Developer Certificate of Origin: every commit in a pull request must carry a |
| 3 | +# `Signed-off-by:` trailer (`git commit -s`) naming the commit's author, with |
| 4 | +# the same name and email (compared case-insensitively). Merge commits are |
| 5 | +# skipped, since they add no authored change of their own. |
| 6 | +# |
| 7 | +# The commit list comes from the pull request API, so the job needs no |
| 8 | +# checkout, no Node action and no third-party DCO app: `gh` and `jq` ship on |
| 9 | +# the hosted runner. The API returns at most 250 commits for a pull request; |
| 10 | +# a longer one fails with a message rather than passing unchecked. |
| 11 | +# |
| 12 | +# Pull requests only, and not while the PR is a draft. |
| 13 | +on: |
| 14 | + pull_request: |
| 15 | + branches: [main] |
| 16 | + types: [opened, synchronize, reopened, ready_for_review] |
| 17 | +# One run per PR per workflow: a new push cancels the older PR run. |
| 18 | +concurrency: |
| 19 | + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} |
| 20 | + cancel-in-progress: true |
| 21 | +permissions: |
| 22 | + contents: read |
| 23 | + pull-requests: read |
| 24 | +jobs: |
| 25 | + dco: |
| 26 | + name: ✍️ DCO sign-off |
| 27 | + if: github.event.pull_request.draft == false |
| 28 | + runs-on: ubuntu-24.04 |
| 29 | + timeout-minutes: 5 |
| 30 | + steps: |
| 31 | + - name: ✍️ Check every commit is signed off by its author |
| 32 | + env: |
| 33 | + GH_TOKEN: ${{ github.token }} |
| 34 | + REPO: ${{ github.repository }} |
| 35 | + PR: ${{ github.event.pull_request.number }} |
| 36 | + EXPECTED: ${{ github.event.pull_request.commits }} |
| 37 | + run: | |
| 38 | + set -euo pipefail |
| 39 | + commits="$(gh api --paginate "repos/$REPO/pulls/$PR/commits?per_page=100" --jq '.[]' | jq -s '.')" |
| 40 | + total="$(jq 'length' <<<"$commits")" |
| 41 | + if [ "$total" -lt "$EXPECTED" ]; then |
| 42 | + echo "::error::The API listed $total of $EXPECTED commits (it stops at 250). Split the pull request so every commit can be checked." |
| 43 | + exit 1 |
| 44 | + fi |
| 45 | + missing="$(jq -r ' |
| 46 | + .[] |
| 47 | + | select((.parents | length) < 2) |
| 48 | + | . as $k |
| 49 | + | ($k.commit.author.name | ascii_downcase) as $name |
| 50 | + | ($k.commit.author.email | ascii_downcase) as $email |
| 51 | + | select([$k.commit.message |
| 52 | + | scan("(?m)^Signed-off-by:[ \t]*([^<\n]*?)[ \t]*<([^>\n]*)>[ \t]*$") |
| 53 | + | select((.[0] | ascii_downcase) == $name and (.[1] | ascii_downcase) == $email) |
| 54 | + ] | length == 0) |
| 55 | + | "\($k.sha[0:12]) \($k.commit.author.name) <\($k.commit.author.email)>" |
| 56 | + ' <<<"$commits")" |
| 57 | + if [ -n "$missing" ]; then |
| 58 | + while IFS= read -r line; do |
| 59 | + echo "::error::Commit $line has no Signed-off-by line matching its author." |
| 60 | + done <<<"$missing" |
| 61 | + echo "Sign off each commit with 'git commit -s'. To fix commits already pushed," |
| 62 | + echo "run 'git rebase --signoff origin/main' and force-push the branch." |
| 63 | + exit 1 |
| 64 | + fi |
| 65 | + echo "All $total commits carry a sign-off matching their author." |
0 commit comments