action.yml

name: DCO Audit
description: |
  Verify Developer Certificate of Origin (Signed-off-by) on all commits
  in a PR range. Posts a structured remediation comment on failure.

inputs:
  base-sha:
    description: "Base branch SHA (github.event.pull_request.base.sha)"
    required: true
  head-sha:
    description: "Head branch SHA (github.event.pull_request.head.sha)"
    required: true
  token:
    description: "GitHub token with pull-requests: write scope"
    required: true
  repo:
    description: "Repository (default: Ikalus1988/MisakaNet)"
    required: false
    default: "Ikalus1988/MisakaNet"
  pr-number:
    description: "PR number (optional). If set, posts a comment on failure."
    required: false
    default: ""

outputs:
  dco-passed:
    description: "true if all commits are signed off, false otherwise"
    value: ${{ steps.scan.outputs.dco_passed }}
  failed-commits-log:
    description: "Newline-separated log of failed commits (sha | subject | author)"
    value: ${{ steps.scan.outputs.failed_commits_log }}
  failed-count:
    description: "Number of commits without sign-off"
    value: ${{ steps.scan.outputs.failed_count }}

runs:
  using: composite
  steps:
    - name: Scan DCO
      id: scan
      shell: bash
      run: |
        BASE_SHA="${{ inputs.base-sha }}"
        HEAD_SHA="${{ inputs.head-sha }}"
        FAILED_LOG=""
        FAILED_COUNT=0

        echo "=== DCO Audit ==="
        echo "  Range: ${BASE_SHA:0:7}..${HEAD_SHA:0:7}"

        while read -r sha; do
          [ -z "$sha" ] && continue
          msg=$(git log -1 --format="%B" "$sha")
          author_email=$(git log -1 --format="%ae" "$sha")
          author_name=$(git log -1 --format="%an" "$sha")
          subject=$(git log -1 --format="%s" "$sha")

          if ! echo "$msg" | grep -qE "Signed-off-by: .* <.*>"; then
            FAILED_LOG="${FAILED_LOG}${sha:0:7} | ${subject} | ${author_name} <${author_email}>\n"
            FAILED_COUNT=$((FAILED_COUNT + 1))
            echo "  ❌ ${sha:0:7} — missing sign-off"
          else
            echo "  ✅ ${sha:0:7} — signed off"
          fi
        done < <(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo "")

        if [ "$FAILED_COUNT" -eq 0 ]; then
          echo "dco_passed=true" >> "$GITHUB_OUTPUT"
          echo "DCO: ALL PASSED"
        else
          echo "dco_passed=false" >> "$GITHUB_OUTPUT"
          echo "DCO: ${FAILED_COUNT} commit(s) FAILED"
        fi

        # Use printf to handle newlines in output
        printf 'failed_commits_log<<DCO_EOF\n%s\nDCO_EOF\n' "$FAILED_LOG" >> "$GITHUB_OUTPUT"
        echo "failed_count=$FAILED_COUNT" >> "$GITHUB_OUTPUT"

    - name: Post DCO Failure Comment
      if: steps.scan.outputs.dco_passed == 'false' && inputs.pr-number != ''
      shell: bash
      env:
        GH_TOKEN: ${{ inputs.token }}
      run: |
        PR="${{ inputs.pr-number }}"
        REPO="${{ inputs.repo }}"
        FAILED_LOG=$(cat << 'DCO_EOF'
        ${{ steps.scan.outputs.failed-commits-log }}
        DCO_EOF
        )
        BASE_REF="${{ inputs.base-sha }}"
        HEAD_REF="${{ inputs.head-sha }}"

        cat > /tmp/dco_comment.md << 'CMTEOF'
        ### 🤖 AUTOMATED AUDIT SYSTEM: REGULATORY BLOCK

        **[STATUS]** AUTO-MERGE: PINNED (BLOCKED)
        **[REASON]** Developer Certificate of Origin (DCO) validation failed.

        ---

        #### 1. COMMIT SIGN-OFF SNAPSHOT

        The following commits in this Pull Request are missing the required `Signed-off-by` line:

        ```text
        CMTEOF
        echo "$FAILED_LOG" >> /tmp/dco_comment.md
        cat >> /tmp/dco_comment.md << 'CMTEOF'
        ```

        #### 2. REMEDIATION PROTOCOL FOR AGENT / CONTRIBUTOR

        Execute the following commands locally within your repository to re-sign and update the branch:

        ```bash
        # Step 1: Rebase to add sign-off to all commits in this PR
        git rebase -i origin/$BASE_REF --exec "git commit --amend --no-edit --signoff"

        # Step 2: Force-push the corrected history back to the remote branch
        git push --force origin $HEAD_REF
        ```

        *Note: This is an automated gate. Once all commits conform to the DCO specification, the Auto-Merge controller will resume execution immediately.*
        CMTEOF

        # Replace variables inside the comment body
        sed -i "s/\$BASE_REF/${{ inputs.base-sha }}/g" /tmp/dco_comment.md
        sed -i "s/\$HEAD_REF/${{ inputs.head-sha }}/g" /tmp/dco_comment.md

        gh pr comment "$PR" --repo "$REPO" --body-file /tmp/dco_comment.md
        echo "Posted DCO failure comment to PR #$PR"