chore: require DCO sign-off on contributions - #71
Merged
Conversation
Adopt the Developer Certificate of Origin 1.1 as the contributor agreement, so contributions carry a certification of origin without a CLA or copyright assignment. While the project has a single copyright holder this also keeps future licensing decisions about non-core surfaces open. - DCO: verbatim Developer Certificate of Origin 1.1. - .github/scripts/check-dco.sh: verifies every commit in a range carries a sign-off matching its author. Skips merge commits (generated, not authored) and bot authors, so Dependabot pull requests stay mergeable. - .github/scripts/check-dco-test.sh: covers the signed, unsigned, mismatched, lowercase-trailer, bot, merge-commit, and moved-base cases. - .github/workflows/dco.yml: runs the verifier on every pull request. - CONTRIBUTING.md, pull request template, README: sign-off instructions. The gate is plain bash and git rather than a third-party action: the contributor path should not add a supply-chain surface the engine refuses to add for itself. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wov74yQN4vdS9XBmDS1kba Signed-off-by: John Siracusa <siracusa5@users.noreply.github.com>
Adversarial review of the previous commit found that the bot exemption relied on `%an`, the commit author's local git name — a field the contributor sets on their own machine before ever pushing. `git config user.name 'x[bot]'` costs nothing, so anyone could exempt their own commit from certification just by naming themselves like a bot. That defeats the point of a gate whose only job is a legal certification of provenance. CI now asks the GitHub API which commits are bot-authored (`author.type == "Bot"`, resolved from the actual account, not commit metadata) and passes that verified SHA list to the script via DCO_BOT_SHAS. The old name heuristic remains, but only as a fallback for local/manual runs, which enforce nothing and where the convenience is harmless. check-dco-test.sh: added the spoofed-name-must-still-fail and verified-sha-skips-regardless-of-name cases; kept the existing bot test covering the unenforced local-heuristic path. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wov74yQN4vdS9XBmDS1kba Signed-off-by: John Siracusa <siracusa5@users.noreply.github.com>
siracusa5
force-pushed
the
claude/context-cake-licensing-xjgbpp
branch
from
July 29, 2026 06:13
81a9d9a to
24c7b25
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DCO) as the contributor agreement — contributors certify they wrote or have the right to submit their work, with no CLA and no copyright assignment..github/workflows/dco.yml) that verifies every commit in a PR carries aSigned-off-bytrailer matching its author, via a plain bash + git script (no third-party action), consistent with the engine's dependency-free stance.CONTRIBUTING.md, the PR template, and the README.Follow-up commit — adversarial review finding, fixed: the original bot-commit exemption matched on the commit author's local git name (
%an). That field is fully attacker-controlled before a contributor ever pushes —git config user.name 'x[bot]'costs nothing — so it would have let anyone exempt their own commit from certification. Fixed by having CI ask the GitHub API which commits are actually bot-authored (author.type == "Bot", tied to the real account) and only trusting that verified list; the name heuristic remains solely as an unenforced convenience for local/manual runs. New tests (check-dco-test.sh) cover the spoofed-name-must-still-fail and verified-sha-skips-regardless-of-name cases.Affected area
Validation
npm test(root suite, unaffected by this change — verified green)npm --prefix apps/console run typechecknpm --prefix apps/console testnpm --prefix apps/console run buildnpm --prefix apps/site run buildapps/consoleorapps/sitetouched. Added:bash .github/scripts/check-dco-test.sh(new, covers 10 scenarios) andbash .github/scripts/check-dco.sh(self-check), both passing.Compatibility
Sign-off
git commit -s) per the Developer Certificate of Origin.🤖 Generated with Claude Code
https://claude.ai/code/session_01Wov74yQN4vdS9XBmDS1kba