From aad2fc562dc527dd1de98f800b617b49a3bfd6c5 Mon Sep 17 00:00:00 2001 From: kperry Date: Thu, 16 Jul 2026 14:30:39 -0500 Subject: [PATCH 1/5] build: enforce DCO sign-off on pull requests Add a DCO status check requiring every human-authored commit to carry a Signed-off-by trailer matching the commit author or committer, certifying https://developercertificate.org. Bot-opened PRs (Dependabot, release-please) are exempt and merge commits are skipped. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 Signed-off-by: kperry --- .github/workflows/dco.yml | 59 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 .github/workflows/dco.yml diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml new file mode 100644 index 0000000..4974a2c --- /dev/null +++ b/.github/workflows/dco.yml @@ -0,0 +1,59 @@ +name: DCO + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + +jobs: + dco: + name: DCO + # Bot-opened PRs (Dependabot, release-please) are exempt: bots cannot + # certify the DCO. A skipped job still satisfies a required status check. + if: ${{ !endsWith(github.event.pull_request.user.login, '[bot]') }} + runs-on: ubuntu-latest + steps: + - name: Verify Signed-off-by on every commit + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + PR: ${{ github.event.pull_request.number }} + run: | + set -euo pipefail + bad=0 + # Merge commits and bot-authored commits are skipped; every other + # commit needs a Signed-off-by trailer whose email matches the + # commit author or committer (Developer Certificate of Origin). + for row in $(gh api "repos/${REPO}/pulls/${PR}/commits" --paginate \ + --jq '.[] | select((.parents | length) < 2) | select(((.author.login // "") | endswith("[bot]")) | not) | @base64'); do + field() { echo "$row" | base64 -d | jq -r "$1"; } + sha=$(field '.sha') + author_email=$(field '.commit.author.email' | tr '[:upper:]' '[:lower:]') + committer_email=$(field '.commit.committer.email' | tr '[:upper:]' '[:lower:]') + signoff_emails=$(field '.commit.message' \ + | grep -E '^Signed-off-by: .+ <[^<>@ ]+@[^<>@ ]+>$' \ + | sed -E 's/.*<([^<>]+)>.*/\1/' \ + | tr '[:upper:]' '[:lower:]' || true) + ok=0 + for email in $signoff_emails; do + if [ "$email" = "$author_email" ] || [ "$email" = "$committer_email" ]; then + ok=1 + fi + done + if [ "$ok" -ne 1 ]; then + echo "::error::commit ${sha} has no Signed-off-by matching its author or committer (${author_email})" + bad=1 + fi + done + if [ "$bad" -ne 0 ]; then + echo "" + echo "One or more commits lack a valid DCO sign-off." + echo "Certify the Developer Certificate of Origin (https://developercertificate.org)" + echo "by signing each commit:" + echo " new commits: git commit -s" + echo " existing commits: git rebase --signoff origin/main && git push --force-with-lease" + exit 1 + fi + echo "All commits carry a valid Signed-off-by." From 26921e51d7e862143e39ddcd1d70a5d96cb446c5 Mon Sep 17 00:00:00 2001 From: kperry Date: Thu, 16 Jul 2026 14:37:05 -0500 Subject: [PATCH 2/5] docs: document DCO, AI disclosure, and issue linking in CONTRIBUTING Add Developer Certificate of Origin, AI-Assisted Contributions, and Linking Issues sections to the contributing guide, matching the org-wide PR template and the DCO check introduced on this branch. Also fix stale godaddy/* repository links left over from the repo move. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 Signed-off-by: kperry --- CONTRIBUTING.md | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2063a54..890f385 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -65,7 +65,7 @@ contributors about the change, discuss the best way to go about implementing it. > pull requests from branches on your fork. To do this, run: > > ``` -> git remote add upstream https://github.com/godaddy/ans.git +> git remote add upstream https://github.com/agentnameservice/ans.git > git fetch upstream > git branch --set-upstream-to=upstream/main main > ``` @@ -108,11 +108,45 @@ Generally speaking, Git handles attribution automatically. Ensure that your contribution follows the standards set by the project's style guide with respect to patterns, naming, documentation and testing. +## Developer Certificate of Origin + +This project follows the Linux Foundation contribution model. Every commit +must carry a `Signed-off-by:` trailer certifying the +[Developer Certificate of Origin](https://developercertificate.org) — your +assertion that you have the right to submit the change under the project's +license. Sign off each commit with: + +``` +git commit -s +``` + +Missing sign-offs on an existing branch can be fixed with +`git rebase --signoff origin/main` followed by a force-push. The `DCO` +status check enforces this on every pull request; PRs opened by bots +(Dependabot, release-please) are exempt, and merge commits are skipped. + +## AI-Assisted Contributions + +AI-assisted contributions are welcome **with disclosure**, following the +[Linux kernel convention](https://docs.kernel.org/process/coding-assistants.html): + +- Disclose the tooling in the pull request's **AI assistance** section, + naming the tool and model, e.g. `Assisted-by: Claude Code (claude-fable-5)`. +- AI tools must never add `Signed-off-by:` lines. DCO certification belongs + to the human submitter, who remains fully responsible for the correctness + and licensing of the contribution. + +## Linking Issues + +Every pull request must reference an issue with a closing keyword (e.g. +`Fixes #123`). Open the issue first — issues are where triage and +prioritization happen. + # Additional Resources - [General GitHub Documentation](https://help.github.com/) - [GitHub Pull Request documentation](https://help.github.com/send-pull-requests/) -[issues]: https://github.com/godaddy/ans/issues +[issues]: https://github.com/agentnameservice/ans/issues [coc]: ./CODE_OF_CONDUCT.md [fork]: https://help.github.com/en/articles/fork-a-repo \ No newline at end of file From e02f97517b36a8bc661aa18536a95d55470d38cf Mon Sep 17 00:00:00 2001 From: kperry Date: Thu, 16 Jul 2026 14:52:29 -0500 Subject: [PATCH 3/5] build: call the org-shared DCO reusable workflow Replace the inlined check with a thin caller of agentnameservice/.github/.github/workflows/dco-check.yml@main so the policy is maintained in one place. This check errors until agentnameservice/.github#6 merges (merge that first). Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 Signed-off-by: kperry --- .github/workflows/dco.yml | 51 +++------------------------------------ 1 file changed, 4 insertions(+), 47 deletions(-) diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml index 4974a2c..026e0c8 100644 --- a/.github/workflows/dco.yml +++ b/.github/workflows/dco.yml @@ -1,5 +1,8 @@ name: DCO +# Thin caller: the actual check lives in the org-shared reusable workflow +# at agentnameservice/.github — fix or extend the policy there, not here. + on: pull_request: types: [opened, synchronize, reopened] @@ -10,50 +13,4 @@ permissions: jobs: dco: name: DCO - # Bot-opened PRs (Dependabot, release-please) are exempt: bots cannot - # certify the DCO. A skipped job still satisfies a required status check. - if: ${{ !endsWith(github.event.pull_request.user.login, '[bot]') }} - runs-on: ubuntu-latest - steps: - - name: Verify Signed-off-by on every commit - env: - GH_TOKEN: ${{ github.token }} - REPO: ${{ github.repository }} - PR: ${{ github.event.pull_request.number }} - run: | - set -euo pipefail - bad=0 - # Merge commits and bot-authored commits are skipped; every other - # commit needs a Signed-off-by trailer whose email matches the - # commit author or committer (Developer Certificate of Origin). - for row in $(gh api "repos/${REPO}/pulls/${PR}/commits" --paginate \ - --jq '.[] | select((.parents | length) < 2) | select(((.author.login // "") | endswith("[bot]")) | not) | @base64'); do - field() { echo "$row" | base64 -d | jq -r "$1"; } - sha=$(field '.sha') - author_email=$(field '.commit.author.email' | tr '[:upper:]' '[:lower:]') - committer_email=$(field '.commit.committer.email' | tr '[:upper:]' '[:lower:]') - signoff_emails=$(field '.commit.message' \ - | grep -E '^Signed-off-by: .+ <[^<>@ ]+@[^<>@ ]+>$' \ - | sed -E 's/.*<([^<>]+)>.*/\1/' \ - | tr '[:upper:]' '[:lower:]' || true) - ok=0 - for email in $signoff_emails; do - if [ "$email" = "$author_email" ] || [ "$email" = "$committer_email" ]; then - ok=1 - fi - done - if [ "$ok" -ne 1 ]; then - echo "::error::commit ${sha} has no Signed-off-by matching its author or committer (${author_email})" - bad=1 - fi - done - if [ "$bad" -ne 0 ]; then - echo "" - echo "One or more commits lack a valid DCO sign-off." - echo "Certify the Developer Certificate of Origin (https://developercertificate.org)" - echo "by signing each commit:" - echo " new commits: git commit -s" - echo " existing commits: git rebase --signoff origin/main && git push --force-with-lease" - exit 1 - fi - echo "All commits carry a valid Signed-off-by." + uses: agentnameservice/.github/.github/workflows/dco-check.yml@main From d06d35b62b72b09ba96b985293de3c33daaa4fe4 Mon Sep 17 00:00:00 2001 From: kperry Date: Thu, 16 Jul 2026 14:59:00 -0500 Subject: [PATCH 4/5] build: use the org-wide DCO app instead of a per-repo workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DCO enforcement moves to https://github.com/apps/dco — the standard across Linux Foundation projects — which validates sign-offs per commit and exempts bot-authored commits and merges by default. Drop the Actions workflow and point CONTRIBUTING at the app. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 Signed-off-by: kperry --- .github/workflows/dco.yml | 16 ---------------- CONTRIBUTING.md | 6 ++++-- 2 files changed, 4 insertions(+), 18 deletions(-) delete mode 100644 .github/workflows/dco.yml diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml deleted file mode 100644 index 026e0c8..0000000 --- a/.github/workflows/dco.yml +++ /dev/null @@ -1,16 +0,0 @@ -name: DCO - -# Thin caller: the actual check lives in the org-shared reusable workflow -# at agentnameservice/.github — fix or extend the policy there, not here. - -on: - pull_request: - types: [opened, synchronize, reopened] - -permissions: - contents: read - -jobs: - dco: - name: DCO - uses: agentnameservice/.github/.github/workflows/dco-check.yml@main diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 890f385..7e1247b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -122,8 +122,10 @@ git commit -s Missing sign-offs on an existing branch can be fixed with `git rebase --signoff origin/main` followed by a force-push. The `DCO` -status check enforces this on every pull request; PRs opened by bots -(Dependabot, release-please) are exempt, and merge commits are skipped. +status check — the org-wide [DCO app](https://github.com/apps/dco), the +same enforcement used across Linux Foundation projects — validates this +on every pull request; bot-authored commits (Dependabot, release-please) +and merge commits are exempt. ## AI-Assisted Contributions From c6bbe1b389d898b80edc5bc1ae0f7d9084418f66 Mon Sep 17 00:00:00 2001 From: kperry Date: Thu, 16 Jul 2026 15:28:26 -0500 Subject: [PATCH 5/5] build: add DCO merge-group shim for the merge queue The DCO app does not report on merge_group commits, so a required DCO check would stall this repo's merge queue. This static shim passes the DCO check for merge groups only; real validation happens on the pull request via the app. Same pattern as onnx/onnx#5399. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 Signed-off-by: kperry --- .github/workflows/dco-merge-group.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 .github/workflows/dco-merge-group.yml diff --git a/.github/workflows/dco-merge-group.yml b/.github/workflows/dco-merge-group.yml new file mode 100644 index 0000000..f8f4302 --- /dev/null +++ b/.github/workflows/dco-merge-group.yml @@ -0,0 +1,19 @@ +name: DCO merge-group shim + +# The org-wide DCO app (https://github.com/apps/dco) validates sign-offs on +# pull requests but does not report on merge-queue (merge_group) commits, so +# a required "DCO" check would stall the queue. This shim reports a passing +# "DCO" check for merge groups only — the real validation already happened +# on the pull request. Same pattern as onnx/onnx#5399. + +on: + merge_group: + +permissions: {} + +jobs: + dco: + name: DCO + runs-on: ubuntu-latest + steps: + - run: echo "DCO was validated on the pull request by the DCO app."