Skip to content

ci: add 14 OSS-standard GitHub workflows (valkey reference parity) #2

ci: add 14 OSS-standard GitHub workflows (valkey reference parity)

ci: add 14 OSS-standard GitHub workflows (valkey reference parity) #2

Workflow file for this run

name: DCO
# CONTRIBUTING.md requires every commit to carry a
# `Signed-off-by:` trailer (Developer Certificate of Origin). The
# lefthook commit-msg hook enforces this locally for maintainers, but
# external contributors opening a PR from a fork cannot run our
# lefthook profile — so we add a server-side check that mirrors it.
on:
pull_request:
branches: [main]
permissions:
contents: read
jobs:
dco:
name: Verify Signed-off-by
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0 # need full history for the commit range
ref: ${{ github.event.pull_request.head.sha }}
- name: Check DCO sign-off on every PR commit
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
set -euo pipefail
# Fetch base so the commit range resolves even on shallow forks.
git fetch --quiet origin "$BASE_SHA"
missing=0
while read -r sha; do
# Skip merge commits (more than one parent).
parents=$(git rev-list --parents -n 1 "$sha" | wc -w)
if [ "$parents" -gt 2 ]; then
echo "::notice ::skipping merge commit $sha"
continue
fi
if ! git log -1 --format=%B "$sha" | grep -qE '^Signed-off-by: .+ <.+@.+>$'; then
author=$(git log -1 --format='%an <%ae>' "$sha")
subject=$(git log -1 --format=%s "$sha")
echo "::error ::commit $sha missing 'Signed-off-by:' trailer"
echo " author : $author"
echo " subject: $subject"
missing=$((missing + 1))
fi
done < <(git rev-list "$BASE_SHA..$HEAD_SHA")
if [ "$missing" -gt 0 ]; then
echo
echo "Add the trailer to every flagged commit with: git commit --amend --signoff"
echo "or for multiple commits: git rebase --signoff $BASE_SHA"
echo "See https://developercertificate.org/ for the policy text."
exit 1
fi
echo "All PR commits carry a Signed-off-by trailer."