Skip to content

Commit 2a0ec32

Browse files
DeusDataDeusData
committed
Adopt the Developer Certificate of Origin for all commits
Every commit must now carry a Signed-off-by trailer matching its author, certifying the right to submit the change under the project's MIT license (DCO 1.1, the Linux kernel mechanism). Enforcement is strict at three layers: a commit-msg hook rejects unsigned commits locally (scripts/install-git-hooks.sh), and the new DCO workflow rejects every push and pull request containing one. Merge commits and bot authors are exempt, matching standard DCO checks. Signed-off-by: Martin Vogel <martin.vogel@datadice.io>
1 parent 1b383e3 commit 2a0ec32

7 files changed

Lines changed: 185 additions & 2 deletions

File tree

‎.github/pull_request_template.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
## What does this PR do?
2+
3+
<!-- Short description of the change and why it is needed. -->
4+
5+
## Checklist
6+
7+
- [ ] Every commit is signed off (`git commit -s`) — required, CI rejects
8+
unsigned commits ([DCO](../DCO), see [CONTRIBUTING.md](../CONTRIBUTING.md))
9+
- [ ] Tests pass locally (`make -f Makefile.cbm test`)
10+
- [ ] Lint passes (`make -f Makefile.cbm lint-ci`)
11+
- [ ] New behavior is covered by a test (reproduce-first for bug fixes)

‎.github/workflows/dco.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# DCO enforcement — every commit on every branch must carry a Signed-off-by
2+
# trailer matching its author (Developer Certificate of Origin 1.1, see DCO).
3+
# Runs on all pushes and pull requests; scripts/check-dco.sh holds the rules.
4+
name: DCO
5+
6+
on:
7+
push:
8+
pull_request:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
dco:
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 5
17+
steps:
18+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
19+
with:
20+
fetch-depth: 0
21+
22+
- name: Check Signed-off-by on all new commits
23+
env:
24+
EVENT: ${{ github.event_name }}
25+
BASE_SHA: ${{ github.event.pull_request.base.sha }}
26+
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
27+
PUSH_BEFORE: ${{ github.event.before }}
28+
PUSH_AFTER: ${{ github.event.after }}
29+
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
30+
run: |
31+
# Ranges always cover only the NEW commits of this event, so history
32+
# predating DCO adoption is naturally exempt.
33+
if [ "$EVENT" = "pull_request" ]; then
34+
RANGE="$BASE_SHA..$HEAD_SHA"
35+
elif [ "$PUSH_BEFORE" = "0000000000000000000000000000000000000000" ]; then
36+
# New branch: check the commits not on the default branch
37+
RANGE="origin/$DEFAULT_BRANCH..$PUSH_AFTER"
38+
else
39+
RANGE="$PUSH_BEFORE..$PUSH_AFTER"
40+
fi
41+
echo "checking range: $RANGE"
42+
scripts/check-dco.sh "$RANGE"

‎CONTRIBUTING.md‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,30 @@ If you add a new `system()`, `popen()`, `fork()`, or network call, it must be ju
162162

163163
Check [issues labeled `good first issue`](https://github.com/DeusData/codebase-memory-mcp/labels/good%20first%20issue) for beginner-friendly tasks with clear scope and guidance.
164164

165-
## License
165+
## License and sign-off (DCO) — required on every commit
166166

167-
By contributing, you agree that your contributions will be licensed under the MIT License.
167+
All contributions are licensed under the project's MIT License
168+
(inbound = outbound). To make that explicit and permanent, this project
169+
uses the [Developer Certificate of Origin 1.1](DCO) — the same mechanism
170+
as the Linux kernel: **every commit must carry a `Signed-off-by` trailer
171+
matching the commit author.**
172+
173+
```bash
174+
git commit -s # adds: Signed-off-by: Your Name <you@example.com>
175+
```
176+
177+
By signing off you certify (per the [DCO](DCO)) that you wrote the change
178+
or otherwise have the right to submit it under the MIT license.
179+
180+
Enforcement is strict and automated:
181+
182+
- CI rejects every push and pull request containing an unsigned commit
183+
(`scripts/check-dco.sh`).
184+
- Install the local hook so unsigned commits are rejected at commit time:
185+
186+
```bash
187+
scripts/install-git-hooks.sh
188+
```
189+
190+
Forgot to sign? `git commit --amend -s` fixes the last commit;
191+
`git rebase --signoff <base>` fixes a whole branch.

‎DCO‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
Developer Certificate of Origin
2+
Version 1.1
3+
4+
Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
5+
6+
Everyone is permitted to copy and distribute verbatim copies of this
7+
license document, but changing it is not allowed.
8+
9+
10+
Developer's Certificate of Origin 1.1
11+
12+
By making a contribution to this project, I certify that:
13+
14+
(a) The contribution was created in whole or in part by me and I
15+
have the right to submit it under the open source license
16+
indicated in the file; or
17+
18+
(b) The contribution is based upon previous work that, to the best
19+
of my knowledge, is covered under an appropriate open source
20+
license and I have the right under that license to submit that
21+
work with modifications, whether created in whole or in part
22+
by me, under the same open source license (unless I am
23+
permitted to submit under a different license), as indicated
24+
in the file; or
25+
26+
(c) The contribution was provided directly to me by some other
27+
person who certified (a), (b) or (c) and I have not modified
28+
it.
29+
30+
(d) I understand and agree that this project and the contribution
31+
are public and that a record of the contribution (including all
32+
personal information I submit with it, including my sign-off) is
33+
maintained indefinitely and may be redistributed consistent with
34+
this project or the open source license(s) involved.

‎scripts/check-dco.sh‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# DCO enforcement: every commit in the given range must carry a
5+
# Signed-off-by trailer whose email matches the commit author
6+
# (Developer Certificate of Origin 1.1 — see the DCO file).
7+
#
8+
# Usage: check-dco.sh <range> e.g. origin/main..HEAD, sha1..sha2
9+
#
10+
# Exemptions (same as the standard DCO checks): merge commits and
11+
# bot-authored commits (author name ending in [bot]).
12+
13+
RANGE="${1:?usage: check-dco.sh <commit-range>}"
14+
15+
FAIL=0
16+
CHECKED=0
17+
while IFS= read -r sha; do
18+
# Skip merge commits
19+
nparents=$(git rev-list --no-walk --parents -n1 "$sha" | wc -w)
20+
if [ "$nparents" -gt 2 ]; then
21+
continue
22+
fi
23+
author_name=$(git log -1 --format='%an' "$sha")
24+
case "$author_name" in
25+
*"[bot]") continue ;;
26+
esac
27+
CHECKED=$((CHECKED + 1))
28+
author_email=$(git log -1 --format='%ae' "$sha")
29+
trailers=$(git log -1 --format='%(trailers:key=Signed-off-by,valueonly)' "$sha")
30+
if ! printf '%s' "$trailers" | grep -qiF "<$author_email>"; then
31+
echo "BLOCKED: $sha lacks a Signed-off-by matching its author:"
32+
git log -1 --format=' author: %an <%ae>%n subject: %s' "$sha"
33+
echo " fix: git commit --amend -s (or: git rebase --signoff <base>)"
34+
FAIL=1
35+
fi
36+
done < <(git rev-list "$RANGE")
37+
38+
if [ "$FAIL" -ne 0 ]; then
39+
echo "=== DCO CHECK FAILED — every commit must be signed off (git commit -s) ==="
40+
echo "=== See the DCO file and CONTRIBUTING.md ==="
41+
exit 1
42+
fi
43+
echo "OK: $CHECKED commit(s) in $RANGE carry a valid Signed-off-by"

‎scripts/git-hooks/commit-msg‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/sh
2+
# commit-msg hook — STRICT DCO enforcement at commit time.
3+
# Every commit must carry a Signed-off-by trailer (git commit -s).
4+
# Install with: scripts/install-git-hooks.sh
5+
6+
if grep -qE '^Signed-off-by: .+ <.+@.+>' "$1"; then
7+
exit 0
8+
fi
9+
10+
echo "" >&2
11+
echo "COMMIT REJECTED: missing Signed-off-by trailer (Developer Certificate of Origin)." >&2
12+
echo "" >&2
13+
echo " Sign your commit: git commit -s" >&2
14+
echo " Fix the last commit: git commit --amend -s" >&2
15+
echo "" >&2
16+
echo "The sign-off certifies you have the right to submit this code under the" >&2
17+
echo "project's MIT license — see the DCO file and CONTRIBUTING.md." >&2
18+
exit 1

‎scripts/install-git-hooks.sh‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# Install the repo's git hooks into .git/hooks (local, per-clone).
5+
# Currently: commit-msg (strict DCO sign-off enforcement).
6+
7+
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
8+
HOOKS_DIR="$(git -C "$ROOT" rev-parse --git-path hooks)"
9+
10+
install -m 755 "$ROOT/scripts/git-hooks/commit-msg" "$HOOKS_DIR/commit-msg"
11+
echo "installed: $HOOKS_DIR/commit-msg (DCO sign-off required on every commit)"

0 commit comments

Comments
 (0)