dco-check.yml

name: DCO Check
on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write
  checks: write

jobs:
  dco:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: DCO Check — require Signed-off-by on all commits
        shell: bash
        run: |
          set +e
          bad=0
          for commit in $(git log --format='%H' origin/${{ github.base_ref }}..HEAD 2>/dev/null || git log --format='%H' HEAD~${{ github.event.pull_request.commits }}..HEAD); do
            msg=$(git log --format='%B' -1 "$commit")
            if ! echo "$msg" | grep -qi 'Signed-off-by:'; then
              echo "❌ Commit $commit is missing Signed-off-by:"
              echo "   $(git log --format='%s' -1 "$commit")"
              bad=$((bad + 1))
            fi
          done
          if [ "$bad" -gt 0 ]; then
            echo ""
            echo "⚠️  All commits must include a Signed-off-by line."
            echo "   Fix: git commit --amend --signoff  (for latest commit)"
            echo "   Or:  git rebase --signoff HEAD~N    (for N commits)"
            exit 1
          fi
          echo "✅ All commits have Signed-off-by."

      - name: Post DCO status on PR
        if: always()
        uses: actions/github-script@v7
        with:
          script: |
            const dcoPass = '${{ job.status }}' === 'success';
            const body = dcoPass
              ? '✅ **DCO Check Passed** — All commits include `Signed-off-by:`. Thank you for respecting code origin!'
              : '❌ **DCO Check Failed** — Some commits are missing `Signed-off-by:`. Please amend with `--signoff`.';
            const conclusion = dcoPass ? 'success' : 'action_required';

            await github.rest.checks.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: 'DCO / Signed-off-by',
              head_sha: context.payload.pull_request.head.sha,
              status: 'completed',
              conclusion: conclusion,
              output: {
                title: 'Developer Certificate of Origin',
                summary: body,
                text: dcoPass
                  ? 'All commits include a Signed-off-by trailer. This certifies that the contributor has the right to submit the code under the project license.'
                  : 'One or more commits are missing the Signed-off-by trailer. Use `git commit --amend --signoff` or `git rebase --signoff` to fix.'
              }
            });