dco-check.yml

name: DCO Check
on:
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number to audit"
        required: false
        type: string

permissions:
  contents: read
  pull-requests: write
  checks: write

jobs:
  dco:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout (pull_request)
        if: github.event_name == 'pull_request'
        uses: actions/checkout@v7
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Checkout (workflow_dispatch)
        if: github.event_name == 'workflow_dispatch'
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Fetch base branch & resolve PR ref (manual)
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_number != ''
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PR_NUM="${{ github.event.inputs.pr_number }}"
          echo "Fetching PR #$PR_NUM head ref..."
          HEAD_REF=$(gh api repos/${{ github.repository }}/pulls/$PR_NUM --jq '.head.ref')
          # 使用 GitHub 提供的 refs/pull/{num}/head 来拉取 fork PR 的 commit
          git fetch origin "pull/$PR_NUM/head:refs/remotes/origin/pr-$PR_NUM-head"
          git checkout "pr-$PR_NUM-head"
          HEAD_SHA=$(git rev-parse HEAD)
          echo "HEAD_SHA=$HEAD_SHA" >> "$GITHUB_ENV"
          echo "HEAD_REF=$HEAD_REF" >> "$GITHUB_ENV"

      - name: Fetch base branch for comparison
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            TARGET="${{ github.base_ref }}"
          else
            TARGET="main"
          fi
          git remote add upstream https://github.com/${{ github.repository }}.git
          git fetch upstream "$TARGET" 2>/dev/null || true

      - name: DCO Check — require Signed-off-by on all commits
        id: dco-check
        shell: bash
        run: |
          set +e
          bad=0
          FAILED_LOG=""
          BASE="${{ github.base_ref || 'main' }}"
          for commit in $(git log --format='%H' "upstream/${BASE}..HEAD" 2>/dev/null); do
            msg=$(git log --format='%B' -1 "$commit")
            if ! echo "$msg" | grep -qi 'Signed-off-by:'; then
              echo "❌ Commit $commit is missing Signed-off-by:"
              echo "   $(git log --format='%s' -1 "$commit")"
              FAILED_LOG="${FAILED_LOG}$(git log -1 --format='%h | %s | %an <%ae>' "$commit")\n"
              bad=$((bad + 1))
            fi
          done

          # Capture failed commits for downstream comment step
          if [ -n "$FAILED_LOG" ]; then
            echo "failed_commits_log<<DCO_EOF" >> "$GITHUB_OUTPUT"
            printf "%b" "$FAILED_LOG" >> "$GITHUB_OUTPUT"
            echo "DCO_EOF" >> "$GITHUB_OUTPUT"

            echo ""
            echo "⚠️  All commits must include a Signed-off-by line."
            echo "   Fix: git commit --amend --signoff  (for latest commit)"
            echo "   Or:  git rebase --signoff HEAD~N    (for N commits)"
            exit 1
          fi
          echo "✅ All commits have Signed-off-by."

      - name: Post DCO status on PR
        if: always()
        continue-on-error: true  # fork PR may not have checks:write permission
        uses: actions/github-script@v9
        with:
          script: |
            try {
              const dcoPass = '${{ job.status }}' === 'success';
              const body = dcoPass
                ? '✅ **DCO Check Passed** — All commits include `Signed-off-by:`. Thank you for respecting code origin!'
                : '❌ **DCO Check Failed** — Some commits are missing `Signed-off-by:`. Please amend with `--signoff`.';
              const conclusion = dcoPass ? 'success' : 'action_required';

              await github.rest.checks.create({
                owner: context.repo.owner,
                repo: context.repo.repo,
                name: 'DCO / Signed-off-by',
                head_sha: context.payload.pull_request.head.sha,
                status: 'completed',
                conclusion: conclusion,
                output: {
                  title: 'Developer Certificate of Origin',
                  summary: body,
                  text: dcoPass
                    ? 'All commits include a Signed-off-by trailer. This certifies that the contributor has the right to submit the code under the project license.'
                    : 'One or more commits are missing the Signed-off-by trailer. Use `git commit --amend --signoff` or `git rebase --signoff` to fix.'
                }
              });
            } catch (e) {
              console.log('Skipping DCO status check (fork PR permission):', e.message);
            }

      # DCO 评论已迁移至 pr-checks.yml 统一管理（使用 SHELDON_PAT）
      # 本 workflow 只通过 Checks API 报告 DCO 状态，不再发 PR 评论