Martin Vogel
2a0ec321c3
Every commit must now carry a Signed-off-by trailer matching its author, certifying the right to submit the change under the project's MIT license (DCO 1.1, the Linux kernel mechanism). Enforcement is strict at three layers: a commit-msg hook rejects unsigned commits locally (scripts/install-git-hooks.sh), and the new DCO workflow rejects every push and pull request containing one. Merge commits and bot authors are exempt, matching standard DCO checks. Signed-off-by: Martin Vogel <martin.vogel@datadice.io>
44 lines
1.5 KiB
Bash
Executable File
44 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# DCO enforcement: every commit in the given range must carry a
|
|
# Signed-off-by trailer whose email matches the commit author
|
|
# (Developer Certificate of Origin 1.1 — see the DCO file).
|
|
#
|
|
# Usage: check-dco.sh <range> e.g. origin/main..HEAD, sha1..sha2
|
|
#
|
|
# Exemptions (same as the standard DCO checks): merge commits and
|
|
# bot-authored commits (author name ending in [bot]).
|
|
|
|
RANGE="${1:?usage: check-dco.sh <commit-range>}"
|
|
|
|
FAIL=0
|
|
CHECKED=0
|
|
while IFS= read -r sha; do
|
|
# Skip merge commits
|
|
nparents=$(git rev-list --no-walk --parents -n1 "$sha" | wc -w)
|
|
if [ "$nparents" -gt 2 ]; then
|
|
continue
|
|
fi
|
|
author_name=$(git log -1 --format='%an' "$sha")
|
|
case "$author_name" in
|
|
*"[bot]") continue ;;
|
|
esac
|
|
CHECKED=$((CHECKED + 1))
|
|
author_email=$(git log -1 --format='%ae' "$sha")
|
|
trailers=$(git log -1 --format='%(trailers:key=Signed-off-by,valueonly)' "$sha")
|
|
if ! printf '%s' "$trailers" | grep -qiF "<$author_email>"; then
|
|
echo "BLOCKED: $sha lacks a Signed-off-by matching its author:"
|
|
git log -1 --format=' author: %an <%ae>%n subject: %s' "$sha"
|
|
echo " fix: git commit --amend -s (or: git rebase --signoff <base>)"
|
|
FAIL=1
|
|
fi
|
|
done < <(git rev-list "$RANGE")
|
|
|
|
if [ "$FAIL" -ne 0 ]; then
|
|
echo "=== DCO CHECK FAILED — every commit must be signed off (git commit -s) ==="
|
|
echo "=== See the DCO file and CONTRIBUTING.md ==="
|
|
exit 1
|
|
fi
|
|
echo "OK: $CHECKED commit(s) in $RANGE carry a valid Signed-off-by"
|