From c7aa8660bf81e567516f84d87d76346b28176975 Mon Sep 17 00:00:00 2001
From: Nathan Gillett <intentproof@gmail.com>
Date: Wed, 13 May 2026 16:29:28 -0500
Subject: [PATCH] Add CI workflow, DCO check, NOTICE, and CONTRIBUTING

Signed-off-by: Nathan Gillett <intentproof@gmail.com>
---
 .github/workflows/ci.yml  | 30 +++++++++++++++++++++++++++++
 .github/workflows/dco.yml | 40 +++++++++++++++++++++++++++++++++++++++
 CONTRIBUTING.md           | 34 +++++++++++++++++++++++++++++++++
 NOTICE                    | 16 ++++++++++++++++
 4 files changed, 120 insertions(+)
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 .github/workflows/dco.yml
 create mode 100644 CONTRIBUTING.md
 create mode 100644 NOTICE

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..f8e1df7
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,30 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          if [ -f pyproject.toml ]; then pip install -e .; fi
+
+      - name: Run tests
+        run: |
+          if [ -z "$(find tests -type f -name '*.py' 2>/dev/null)" ]; then
+            echo "No test files found (project scaffold only)"
+            exit 0
+          fi
+          python -m unittest discover -s tests -v
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
new file mode 100644
index 0000000..958c111
--- /dev/null
+++ b/.github/workflows/dco.yml
@@ -0,0 +1,40 @@
+name: dco
+
+on:
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Require Signed-off-by trailer on every commit
+        run: |
+          base="${{ github.event.pull_request.base.sha }}"
+          head="${{ github.event.pull_request.head.sha }}"
+          fail=0
+          for sha in $(git rev-list "$base".."$head"); do
+            body=$(git log -1 --format=%B "$sha")
+            author_email=$(git log -1 --format=%ae "$sha")
+            soby=$(echo "$body" | grep -oE '^Signed-off-by: .+ <.+@.+>$' || true)
+            if [ -z "$soby" ]; then
+              echo "Commit $sha is missing a Signed-off-by trailer." >&2
+              fail=1
+            else
+              soby_email=$(echo "$soby" | grep -oE '<.+@.+>' | tr -d '<>')
+              if [ "$soby_email" != "$author_email" ]; then
+                echo "Commit $sha: Signed-off-by email ($soby_email) does not match author email ($author_email)." >&2
+                fail=1
+              fi
+            fi
+          done
+          if [[ $fail -ne 0 ]]; then
+            echo "" >&2
+            echo "All commits in this PR must be signed off via the DCO." >&2
+            echo "See CONTRIBUTING.md. Use 'git commit -s' or amend with 'git commit --amend -s'." >&2
+            exit 1
+          fi
+          echo "PASS: all commits carry Signed-off-by trailers."
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..76de210
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,34 @@
+# Contributing to intentproof-sdk-python
+
+Thanks for your interest in contributing to the IntentProof Python SDK.
+
+## Developer Certificate of Origin (DCO)
+
+This repository accepts contributions under the
+[Developer Certificate of Origin 1.1](https://developercertificate.org/).
+We deliberately use DCO instead of a Contributor License Agreement
+for the Apache repositories so the contribution path stays
+frictionless.
+
+Every commit must carry a `Signed-off-by:` trailer matching the
+author email. The easiest way to do this is to pass `-s` to `git
+commit`:
+
+```bash
+git commit -s -m "..."
+```
+
+You can also retroactively sign off the last commit with:
+
+```bash
+git commit --amend --no-edit -s
+```
+
+Then force-push the amended branch:
+
+```bash
+git push --force-with-lease
+```
+
+Commits that do not include a valid `Signed-off-by` trailer will
+be rejected by CI.
diff --git a/NOTICE b/NOTICE
new file mode 100644
index 0000000..b5665fd
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,16 @@
+IntentProof Python SDK
+Copyright 2026 IntentProof, Inc.
+
+This product includes software developed at IntentProof, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.