dco.yml

name: Developer Certificate of Origin

on:
  pull_request:
    branches: [dev, main]

permissions:
  contents: read

jobs:
  signoff:
    name: DCO sign-off
    runs-on: ubuntu-latest
    steps:
      - name: Checkout pull request history
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0

      - name: Verify every pull request commit
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          # DCO was introduced on dev by PR #208. Commits already reachable
          # from this baseline predate enforcement and remain exempt.
          DCO_BASELINE_SHA: 1d9469e162fce788bca839cfaf8a3e66ca35cf9b
        run: python scripts/check_dco.py "$BASE_SHA" "$HEAD_SHA" "$DCO_BASELINE_SHA"