fix-dco.yml

name: DCO Auto-Fix
on:
  issue_comment:
    types: [created]

permissions:
  contents: write
  pull-requests: write

jobs:
  fix-dco:
    if: |
      github.event.issue.pull_request &&
      contains(github.event.comment.body, '/fix-dco') &&
      (github.event.comment.user.login == github.event.issue.user.login ||
       contains(fromJSON('["MEMBER", "OWNER", "COLLABORATOR"]'), github.event.comment.author_association))
    runs-on: ubuntu-latest
    steps:
      - name: Get PR info
        id: pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PR_JSON=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.issue.number }} \
            --jq '{headRef: .head.ref, headRepo: .head.repo.full_name, headLabel: .head.label, baseRef: .base.ref}')
          echo "headRef=$(echo $PR_JSON | jq -r '.headRef')" >> $GITHUB_OUTPUT
          echo "headRepo=$(echo $PR_JSON | jq -r '.headRepo')" >> $GITHUB_OUTPUT
          echo "baseRef=$(echo $PR_JSON | jq -r '.baseRef')" >> $GITHUB_OUTPUT
          echo "isFork=$([ "$(echo $PR_JSON | jq -r '.headRepo')" != "${{ github.repository }}" ] && echo true || echo false)" >> $GITHUB_OUTPUT

      - name: Handle fork PR — manual instructions only
        if: steps.pr.outputs.isFork == 'true'
        uses: actions/github-script@v9
        with:
          script: |
            await github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: [
                "⚠️ **Auto-fix not available for fork PRs.**",
                "",
                "Since this PR is from a fork, the bot can't push changes directly. Please fix DCO manually:",
                "",
                "```bash",
                "git rebase --signoff HEAD~N   # N = number of commits to fix",
                "git push --force",
                "```",
                "",
                "Or for the latest commit only:",
                "```bash",
                "git commit --amend --signoff --no-edit",
                "git push --force",
                "```",
              ].join('\n')
            });

      - name: Validate this is a PR issue
        if: steps.pr.outputs.isFork != 'true'
        uses: actions/github-script@v9
        with:
          script: |
            const issue = await github.rest.issues.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            if (!issue.data.pull_request) {
              core.setFailed('This issue is not a pull request');
            }

      - name: Checkout PR branch (same-repo only, with path isolation)
        if: steps.pr.outputs.isFork != 'true'
        uses: actions/checkout@v7
        with:
          repository: ${{ github.repository }}
          ref: refs/pull/${{ github.event.issue.number }}/head
          fetch-depth: 0
          path: pr-code
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure git safe directory
        run: git config --global safe.directory '*'

      - name: Configure git (same-repo only)
        if: steps.pr.outputs.isFork != 'true'
        working-directory: pr-code
        run: |
          git config user.name "misakanet-bot"
          git config user.email "bot@misakanet.dev"

      - name: Rebase with signoff (same-repo only)
        if: steps.pr.outputs.isFork != 'true'
        working-directory: pr-code
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          BASE="${{ steps.pr.outputs.baseRef }}"
          echo "Rebasing against $BASE..."
          git rebase --signoff "origin/$BASE" 2>&1 || {
            echo "Rebase with base failed — trying HEAD~N fallback"
            git rebase --abort 2>/dev/null
            MB=$(git merge-base "origin/$BASE" HEAD)
            N=$(git rev-list --count "$MB..HEAD")
            if [ "$N" -gt 0 ] && [ "$N" -le 10 ]; then
              GIT_SEQUENCE_EDITOR=: git rebase --signoff HEAD~"$N" || {
                echo "Could not auto-fix DCO. Manual fix required."
                exit 1
              }
            else
              echo "Too many commits ($N) or none to fix. Manual fix required."
              exit 1
            fi
          }
          echo "DCO fix applied."

      - name: Force push (same-repo only)
        if: steps.pr.outputs.isFork != 'true'
        working-directory: pr-code
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git remote set-url origin https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git
          git push --force-with-lease origin HEAD:refs/heads/${{ steps.pr.outputs.headRef }} 2>&1 || {
            echo "Force push failed — branch may have diverged"
            exit 1
          }

      - name: Post success comment (same-repo only)
        if: steps.pr.outputs.isFork != 'true'
        uses: actions/github-script@v9
        with:
          script: |
            await github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: "✅ **DCO Auto-Fix applied!** All commits have been signed off and pushed. CI checks should re-trigger shortly."
            });