Add dark-background nib mark variant #60
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: dco | |
| # Developer Certificate of Origin gate. Every commit in a pull request must | |
| # carry a `Signed-off-by:` trailer whose email matches the commit author, per | |
| # governance/DCO.txt and the "Sign your commits (DCO)" section of CONTRIBUTING. | |
| # The check is a short inline shell walk over the PR commit range, so there is | |
| # no third-party action to pin and no token beyond read access to the diff. | |
| on: | |
| pull_request: | |
| permissions: {} | |
| concurrency: | |
| group: dco-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| dco: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # Full history so the base..head range is walkable; the checkout is | |
| # read-only and its credentials are never persisted into the tree. | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Verify Signed-off-by on every commit | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| run: | | |
| set -euo pipefail | |
| # Automated pull requests opened by GitHub App bot accounts (whose | |
| # login GitHub reserves with a "[bot]" suffix) are exempt: the DCO is | |
| # a human-contributor IP attestation, and a bot's dependency-bump | |
| # commits carry no sign-off. The authenticated PR-opener login is used | |
| # rather than the spoofable git author. The fixed-string case glob | |
| # avoids regex-escaping the brackets. | |
| case "$PR_AUTHOR" in | |
| *'[bot]') | |
| echo "PR opened by a bot account (${PR_AUTHOR}); DCO sign-off is not required for automated commits." | |
| exit 0 | |
| ;; | |
| esac | |
| # Non-merge commits introduced by this PR. Merge commits created by | |
| # GitHub carry no author sign-off and are not authored by a | |
| # contributor, so they are excluded. | |
| commits=$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}") | |
| if [ -z "$commits" ]; then | |
| echo "No non-merge commits to check." | |
| exit 0 | |
| fi | |
| fail=0 | |
| for sha in $commits; do | |
| author_email=$(git show -s --format='%ae' "$sha") | |
| subject=$(git show -s --format='%s' "$sha") | |
| # A valid sign-off is a trailer line whose email matches the commit | |
| # author's email. `git log --format=%(trailers...)` reads only the | |
| # trailer block, so a "Signed-off-by" mentioned in prose does not | |
| # count. | |
| signoffs=$(git show -s --format='%(trailers:key=Signed-off-by,valueonly)' "$sha") | |
| if printf '%s\n' "$signoffs" | grep -qiF "<${author_email}>"; then | |
| echo "ok $sha $subject" | |
| else | |
| echo "MISS $sha $subject" | |
| echo " expected: Signed-off-by: <name> <${author_email}>" | |
| fail=1 | |
| fi | |
| done | |
| if [ "$fail" -ne 0 ]; then | |
| echo | |
| echo "One or more commits are missing a matching Signed-off-by trailer." | |
| echo "Add one to each commit with 'git commit -s', or repair the range with:" | |
| echo " git rebase --exec 'git commit --amend --no-edit -s' ${BASE_SHA}" | |
| echo "See governance/DCO.txt and the DCO section of CONTRIBUTING.md." | |
| exit 1 | |
| fi | |
| echo | |
| echo "All commits carry a valid Signed-off-by trailer." |