dco.yml

name: DCO

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  pull-requests: read
  contents: read

jobs:
  check:
    name: DCO Sign-off Check
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Check DCO sign-off
        run: |
          # Get all commits in the PR
          BASE_SHA="${{ github.event.pull_request.base.sha }}"
          HEAD_SHA="${{ github.event.pull_request.head.sha }}"

          echo "Checking commits from $BASE_SHA to $HEAD_SHA"

          MISSING_SIGNOFF=0
          while read -r COMMIT; do
            if [ -z "$COMMIT" ]; then
              continue
            fi

            # Check if commit has Signed-off-by
            if ! git log -1 --format='%B' "$COMMIT" | grep -q "^Signed-off-by:"; then
              echo "::error::Commit $COMMIT is missing DCO sign-off (Signed-off-by line)"
              echo "  Message: $(git log -1 --format='%s' "$COMMIT")"
              MISSING_SIGNOFF=1
            else
              echo "OK: $COMMIT has DCO sign-off"
            fi
          done < <(git rev-list "$BASE_SHA".."$HEAD_SHA")

          if [ "$MISSING_SIGNOFF" -eq 1 ]; then
            echo ""
            echo "::error::Some commits are missing DCO sign-off."
            echo "Please sign off your commits using: git commit -s"
            echo "See: https://developercertificate.org/"
            exit 1
          fi

          echo "All commits have DCO sign-off!"