Christian Sass
aeb8065807
Vitals takes contributions under MIT, inbound equal to outbound, with a Developer Certificate of Origin instead of a CLA. That is the same shape Nextcloud uses on the project this tool was written to watch, so nobody contributing here is being asked for paperwork they would not sign upstream. tools/check-dco.sh verifies both presence and identity of the sign-off, and fails the pull request if either is wrong. Tested against three cases: unsigned, correctly signed, and signed by someone other than the author. Signed-off-by: Christian Sass <csass@binaryranch.com>
15 lines
295 B
YAML
15 lines
295 B
YAML
name: DCO
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
signoff:
|
|
runs-on: docker
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Every commit must be signed off
|
|
run: bash tools/check-dco.sh "origin/${{ github.base_ref }}..HEAD"
|