Adopt the Developer Certificate of Origin for all commits
Every commit must now carry a Signed-off-by trailer matching its author, certifying the right to submit the change under the project's MIT license (DCO 1.1, the Linux kernel mechanism). Enforcement is strict at three layers: a commit-msg hook rejects unsigned commits locally (scripts/install-git-hooks.sh), and the new DCO workflow rejects every push and pull request containing one. Merge commits and bot authors are exempt, matching standard DCO checks. Signed-off-by: Martin Vogel <martin.vogel@datadice.io>
This commit is contained in:
Martin Vogel
@@ -0,0 +1,11 @@
|
||||
## What does this PR do?
|
||||
|
||||
<!-- Short description of the change and why it is needed. -->
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Every commit is signed off (`git commit -s`) — required, CI rejects
|
||||
unsigned commits ([DCO](../DCO), see [CONTRIBUTING.md](../CONTRIBUTING.md))
|
||||
- [ ] Tests pass locally (`make -f Makefile.cbm test`)
|
||||
- [ ] Lint passes (`make -f Makefile.cbm lint-ci`)
|
||||
- [ ] New behavior is covered by a test (reproduce-first for bug fixes)
|
||||
@@ -0,0 +1,42 @@
|
||||
# DCO enforcement — every commit on every branch must carry a Signed-off-by
|
||||
# trailer matching its author (Developer Certificate of Origin 1.1, see DCO).
|
||||
# Runs on all pushes and pull requests; scripts/check-dco.sh holds the rules.
|
||||
name: DCO
|
||||
|
||||
on:
|
||||
push:
|
||||
pull_request:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
dco:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 5
|
||||
steps:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Check Signed-off-by on all new commits
|
||||
env:
|
||||
EVENT: ${{ github.event_name }}
|
||||
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
||||
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
||||
PUSH_BEFORE: ${{ github.event.before }}
|
||||
PUSH_AFTER: ${{ github.event.after }}
|
||||
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
|
||||
run: |
|
||||
# Ranges always cover only the NEW commits of this event, so history
|
||||
# predating DCO adoption is naturally exempt.
|
||||
if [ "$EVENT" = "pull_request" ]; then
|
||||
RANGE="$BASE_SHA..$HEAD_SHA"
|
||||
elif [ "$PUSH_BEFORE" = "0000000000000000000000000000000000000000" ]; then
|
||||
# New branch: check the commits not on the default branch
|
||||
RANGE="origin/$DEFAULT_BRANCH..$PUSH_AFTER"
|
||||
else
|
||||
RANGE="$PUSH_BEFORE..$PUSH_AFTER"
|
||||
fi
|
||||
echo "checking range: $RANGE"
|
||||
scripts/check-dco.sh "$RANGE"
|
||||
+26
-2
@@ -162,6 +162,30 @@ If you add a new `system()`, `popen()`, `fork()`, or network call, it must be ju
|
||||
|
||||
Check [issues labeled `good first issue`](https://github.com/DeusData/codebase-memory-mcp/labels/good%20first%20issue) for beginner-friendly tasks with clear scope and guidance.
|
||||
|
||||
## License
|
||||
## License and sign-off (DCO) — required on every commit
|
||||
|
||||
By contributing, you agree that your contributions will be licensed under the MIT License.
|
||||
All contributions are licensed under the project's MIT License
|
||||
(inbound = outbound). To make that explicit and permanent, this project
|
||||
uses the [Developer Certificate of Origin 1.1](DCO) — the same mechanism
|
||||
as the Linux kernel: **every commit must carry a `Signed-off-by` trailer
|
||||
matching the commit author.**
|
||||
|
||||
```bash
|
||||
git commit -s # adds: Signed-off-by: Your Name <you@example.com>
|
||||
```
|
||||
|
||||
By signing off you certify (per the [DCO](DCO)) that you wrote the change
|
||||
or otherwise have the right to submit it under the MIT license.
|
||||
|
||||
Enforcement is strict and automated:
|
||||
|
||||
- CI rejects every push and pull request containing an unsigned commit
|
||||
(`scripts/check-dco.sh`).
|
||||
- Install the local hook so unsigned commits are rejected at commit time:
|
||||
|
||||
```bash
|
||||
scripts/install-git-hooks.sh
|
||||
```
|
||||
|
||||
Forgot to sign? `git commit --amend -s` fixes the last commit;
|
||||
`git rebase --signoff <base>` fixes a whole branch.
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
Developer Certificate of Origin
|
||||
Version 1.1
|
||||
|
||||
Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
|
||||
|
||||
Everyone is permitted to copy and distribute verbatim copies of this
|
||||
license document, but changing it is not allowed.
|
||||
|
||||
|
||||
Developer's Certificate of Origin 1.1
|
||||
|
||||
By making a contribution to this project, I certify that:
|
||||
|
||||
(a) The contribution was created in whole or in part by me and I
|
||||
have the right to submit it under the open source license
|
||||
indicated in the file; or
|
||||
|
||||
(b) The contribution is based upon previous work that, to the best
|
||||
of my knowledge, is covered under an appropriate open source
|
||||
license and I have the right under that license to submit that
|
||||
work with modifications, whether created in whole or in part
|
||||
by me, under the same open source license (unless I am
|
||||
permitted to submit under a different license), as indicated
|
||||
in the file; or
|
||||
|
||||
(c) The contribution was provided directly to me by some other
|
||||
person who certified (a), (b) or (c) and I have not modified
|
||||
it.
|
||||
|
||||
(d) I understand and agree that this project and the contribution
|
||||
are public and that a record of the contribution (including all
|
||||
personal information I submit with it, including my sign-off) is
|
||||
maintained indefinitely and may be redistributed consistent with
|
||||
this project or the open source license(s) involved.
|
||||
Executable
+43
@@ -0,0 +1,43 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# DCO enforcement: every commit in the given range must carry a
|
||||
# Signed-off-by trailer whose email matches the commit author
|
||||
# (Developer Certificate of Origin 1.1 — see the DCO file).
|
||||
#
|
||||
# Usage: check-dco.sh <range> e.g. origin/main..HEAD, sha1..sha2
|
||||
#
|
||||
# Exemptions (same as the standard DCO checks): merge commits and
|
||||
# bot-authored commits (author name ending in [bot]).
|
||||
|
||||
RANGE="${1:?usage: check-dco.sh <commit-range>}"
|
||||
|
||||
FAIL=0
|
||||
CHECKED=0
|
||||
while IFS= read -r sha; do
|
||||
# Skip merge commits
|
||||
nparents=$(git rev-list --no-walk --parents -n1 "$sha" | wc -w)
|
||||
if [ "$nparents" -gt 2 ]; then
|
||||
continue
|
||||
fi
|
||||
author_name=$(git log -1 --format='%an' "$sha")
|
||||
case "$author_name" in
|
||||
*"[bot]") continue ;;
|
||||
esac
|
||||
CHECKED=$((CHECKED + 1))
|
||||
author_email=$(git log -1 --format='%ae' "$sha")
|
||||
trailers=$(git log -1 --format='%(trailers:key=Signed-off-by,valueonly)' "$sha")
|
||||
if ! printf '%s' "$trailers" | grep -qiF "<$author_email>"; then
|
||||
echo "BLOCKED: $sha lacks a Signed-off-by matching its author:"
|
||||
git log -1 --format=' author: %an <%ae>%n subject: %s' "$sha"
|
||||
echo " fix: git commit --amend -s (or: git rebase --signoff <base>)"
|
||||
FAIL=1
|
||||
fi
|
||||
done < <(git rev-list "$RANGE")
|
||||
|
||||
if [ "$FAIL" -ne 0 ]; then
|
||||
echo "=== DCO CHECK FAILED — every commit must be signed off (git commit -s) ==="
|
||||
echo "=== See the DCO file and CONTRIBUTING.md ==="
|
||||
exit 1
|
||||
fi
|
||||
echo "OK: $CHECKED commit(s) in $RANGE carry a valid Signed-off-by"
|
||||
Executable
+18
@@ -0,0 +1,18 @@
|
||||
#!/bin/sh
|
||||
# commit-msg hook — STRICT DCO enforcement at commit time.
|
||||
# Every commit must carry a Signed-off-by trailer (git commit -s).
|
||||
# Install with: scripts/install-git-hooks.sh
|
||||
|
||||
if grep -qE '^Signed-off-by: .+ <.+@.+>' "$1"; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "" >&2
|
||||
echo "COMMIT REJECTED: missing Signed-off-by trailer (Developer Certificate of Origin)." >&2
|
||||
echo "" >&2
|
||||
echo " Sign your commit: git commit -s" >&2
|
||||
echo " Fix the last commit: git commit --amend -s" >&2
|
||||
echo "" >&2
|
||||
echo "The sign-off certifies you have the right to submit this code under the" >&2
|
||||
echo "project's MIT license — see the DCO file and CONTRIBUTING.md." >&2
|
||||
exit 1
|
||||
Executable
+11
@@ -0,0 +1,11 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# Install the repo's git hooks into .git/hooks (local, per-clone).
|
||||
# Currently: commit-msg (strict DCO sign-off enforcement).
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
HOOKS_DIR="$(git -C "$ROOT" rev-parse --git-path hooks)"
|
||||
|
||||
install -m 755 "$ROOT/scripts/git-hooks/commit-msg" "$HOOKS_DIR/commit-msg"
|
||||
echo "installed: $HOOKS_DIR/commit-msg (DCO sign-off required on every commit)"
|
||||
Reference in New Issue
Block a user