Repository navigation
ci(deps): bump github/codeql-action from 4.36.1 to 4.36.2 #80
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: DCO | |
| # Verifies every commit in a pull request carries a Developer Certificate of | |
| # Origin sign-off (a `Signed-off-by:` trailer). See CONTRIBUTING.md > "Sign your | |
| # work (DCO)". Self-contained, no third-party action. | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| permissions: | |
| contents: read | |
| jobs: | |
| dco-check: | |
| name: Verify Developer Certificate of Origin sign-off | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out full history | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Verify Signed-off-by on every commit | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| fail=0 | |
| commits="$(git rev-list "${BASE_SHA}..${HEAD_SHA}")" | |
| if [ -z "${commits}" ]; then | |
| echo "No commits to check." | |
| exit 0 | |
| fi | |
| for sha in ${commits}; do | |
| # Skip merge commits (more than one parent). | |
| parents="$(git rev-list --parents -n 1 "${sha}" | wc -w)" | |
| if [ "${parents}" -gt 2 ]; then | |
| echo "skip merge commit ${sha}" | |
| continue | |
| fi | |
| # Skip commits authored by a bot (release-please, dependabot, ...); | |
| # the DCO applies to human contributions. | |
| author_name="$(git show -s --format='%an' "${sha}")" | |
| case "${author_name}" in | |
| *"[bot]") echo "skip bot commit ${sha} (${author_name})"; continue ;; | |
| esac | |
| if git show -s --format='%B' "${sha}" | grep -qiE "^Signed-off-by: .+ <.+@.+>"; then | |
| echo "ok ${sha}" | |
| else | |
| author="$(git show -s --format='%an <%ae>' "${sha}")" | |
| echo "::error::Commit ${sha} (${author}) is missing a 'Signed-off-by' line." | |
| fail=1 | |
| fi | |
| done | |
| if [ "${fail}" -ne 0 ]; then | |
| echo "" | |
| echo "Sign your commits, then push again:" | |
| echo " git commit --amend --signoff # last commit" | |
| echo " git rebase --signoff origin/main # a whole branch" | |
| echo "See CONTRIBUTING.md > 'Sign your work (DCO)'." | |
| exit 1 | |
| fi | |
| echo "All commits signed off." |