ci(dco): add DCO enforcement workflow (#425)

* ci(dco): add DCO enforcement workflow
## Summary
Add Developer Certificate of Origin (DCO) check for all pull requests
using dco-check (PyPI) with SHA-pinned actions and hash-verified pip install.
## Changes
- Add .github/workflows/dco.yml with dco-check==0.5.0 (hash-pinned)
- Add DCO section to CONTRIBUTING.md with sign-off instructions
- Add --signoff requirement to AGENTS.md Key Constraints
Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Model-Raw: claude-opus-4-6

* fix(ci): use requirements file for pip hash verification
## Summary
Fix DCO Check workflow failure. pip's --hash option is only available
via requirements files, not as a CLI argument.
## Changes
- Write requirements to temp file with hash, then install via -r flag
Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Model-Raw: claude-opus-4-6

* fix(ci): add GITHUB_TOKEN env for dco-check
## Summary
dco-check requires GITHUB_TOKEN to fetch PR commit data via GitHub API.
## Changes
- Add GITHUB_TOKEN env to Run DCO Check step
Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Model-Raw: claude-opus-4-6

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: nullvariant

.github/workflows/dco.yml

@@ -0,0 +1,39 @@
+name: DCO
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  dco:
+    name: DCO Check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Setup Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Run DCO Check
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo 'dco-check==0.5.0 --hash=sha256:3c027d2d47b5cbb03f7e2a25ec8ffb56d8a33c49563c8fcd2cef443ebf3cff0d' > /tmp/requirements-dco.txt
+          pip install --require-hashes --no-deps -r /tmp/requirements-dco.txt
+          dco-check

AGENTS.md

@@ -12,6 +12,7 @@ VS Code extensions monorepo. Primary extension: **Git ID Switcher** — manages
 4. Do not make security constants user-configurable — hardcoded security values are by design.
 5. Do not add features outside the current scope (e.g., GitHub API integration).
 6. Minimize dependencies — add only when genuinely needed and not replaceable by existing tools.
+7. Include `--signoff` flag on all commits (DCO requirement).
 
 ## Branch Protection
 

CONTRIBUTING.md

@@ -13,16 +13,46 @@ The `main` branch is protected with the following rules:
 
 > **Note for contributors**: You don't need to GPG-sign your commits. The maintainer will handle signing when merging your PR.
 
+## Developer Certificate of Origin (DCO)
+
+This project requires all contributors to sign off their commits, certifying that they have the right to submit the code under the project's license. This is enforced via the [Developer Certificate of Origin](https://developercertificate.org/).
+
+### How to sign off
+
+Add `--signoff` (or `-s`) to your `git commit` command:
+
+```bash
+git commit --signoff -m "feat: add new feature"
+```
+
+This adds a `Signed-off-by` line to your commit message:
+
+```text
+feat: add new feature
+
+Signed-off-by: Your Name <your.email@example.com>
+```
+
+### What you are certifying
+
+By signing off, you certify the [Developer Certificate of Origin v1.1](https://developercertificate.org/) (full text at the link). Key points:
+
+- The contribution is your original work, or you have the right to pass it on
+- You have the right to submit it under the project's open source license
+- You understand the contribution is public and a record of it is maintained indefinitely
+
+> **Note**: If you forget `--signoff`, the DCO check on your PR will fail. You can fix existing commits with `git commit --amend --signoff` or `git rebase --signoff HEAD~N`.
+
 ## Getting Started
 
 1. Fork the repository
 2. Clone your fork
 3. Create a feature branch: `git checkout -b feature/my-feature`
 4. Make your changes
-5. Commit with a descriptive message
+5. Commit with `--signoff`: `git commit --signoff -m "feat: description"`
 6. Push to your fork
 7. Open a Pull Request
-8. Wait for CI checks to pass, then a maintainer will merge
+8. Wait for CI checks to pass (including DCO), then a maintainer will merge
 
 ## Development Setup
 

extensions/git-id-switcher/src/ui/documentationInternal.ts

@@ -22,9 +22,9 @@
  * Unknown paths or hash mismatches result in content rejection.
  */
 export const DOCUMENT_HASHES: Record<string, string> = {
-  'AGENTS.md': '5576e35cba6912b02c0bc5e7f51fc15a2a6e5f125e68cc7a6a450cdddc5e5ca5',
+  'AGENTS.md': 'c4918e12fd7900bfc41e708992ebc4b7326600ce9327e8020a986fe4dd807f8d',
   'CODE_OF_CONDUCT.md': 'a0e9cb2e004663cdedef4e1adc0e429417ccfc479e367cbc17b869f62ae759d2',
-  'CONTRIBUTING.md': '86390ee951cf08f616d75f35c0746f0005be6aee29b1a3abb5745ffb823914fb',
+  'CONTRIBUTING.md': 'ed4d1f391ffe04e3031dfc9f16fd8fd5dcd54ba23af3b3202c07adac5ba23da7',
   'extensions/git-id-switcher/CHANGELOG.md': 'b11d9b619f23b9e55c31302b9a55f455ade9c58f65ce485b0d6ae4ddeb289e7a',
   'extensions/git-id-switcher/docs/ARCHITECTURE.md': 'db6ba2f7809b2c7aa831eda3a4b9bb80521577e4e267c7b6ccad17ffba847548',
   'extensions/git-id-switcher/docs/CONTRIBUTING.md': '7d6ad2bc4d8c838790754cb9df848cb65f9fdce7e1a13e5c965b83a3d5b6378c',