From 5e6447627c5e3706d2fe356dff2482bdb6e6db99 Mon Sep 17 00:00:00 2001 From: Fredrik Ahlgren Date: Sun, 16 Aug 2026 08:12:10 +0000 Subject: [PATCH] ci(dco): ask for a sign-off on authored commits, not on merge commits Branch protection requires a pull request to be up to date with main before it merges, and the merge commit GitHub's "Update branch" button writes carries no Signed-off-by trailer. The check counted it, so bringing a stale pull request up to date was the act that made it unmergeable. There was no way out from inside the rule. Fixing it means force-pushing a trailer onto a commit the contributor did not write, and for a pull request from a fork this repository cannot push to, nobody who can merge can also do that. It deadlocked #65 -- which had to be relanded as #83 to carry a one-line trailer -- and a0d5d73 on that same branch before it. Every fork pull request reaching main after another one merges would have hit it next. A sign-off certifies authored content. A merge commit from the update button carries none, so the check now asks for the trailer on the commits that do, the same line the upstream DCO app draws. A conflict resolved inside a merge commit becomes content the check no longer sees; the reviewable content still arrives on the authored commits either side of it. The failure message now also names the two commands that fix a genuine miss. Verified against the commit range that failed on #65 (4fb8608..01da267): it fails under the old rule and passes under the new one, while an authored commit with no trailer still fails. Signed-off-by: Fredrik Ahlgren --- .github/workflows/validate.yml | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index ae2ab85..5a9792f 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -104,6 +104,19 @@ jobs: --output-dir "/tmp/device-driver-candidates/$id" done + # The sign-off certifies authored content, so this asks it of the commits that + # carry some, and skips merge commits. + # + # A pull request that falls behind main has to be brought up to date before it + # can merge, and the merge commit GitHub's "Update branch" button writes has no + # Signed-off-by trailer. Counting it made a stale pull request unmergeable + # until someone force-pushed a trailer onto a commit they did not write, which + # nobody can do on a fork this repository cannot push to. That deadlocked #65 + # and, before it, a0d5d73 on the same branch. + # + # The trade-off is that a conflict resolved inside a merge commit is content + # this check no longer sees. That is the same line the upstream DCO app draws, + # and the reviewable content still arrives on the authored commits either side. dco: if: github.event_name == 'pull_request' runs-on: ubuntu-latest @@ -122,7 +135,11 @@ jobs: echo "Missing Signed-off-by: $commit" >&2 missing=1 fi - done < <(git rev-list "$BASE_SHA..$HEAD_SHA") + done < <(git rev-list --no-merges "$BASE_SHA..$HEAD_SHA") + if [ "$missing" -ne 0 ]; then + echo "Sign off with 'git commit -s', or add the trailer to the commits above" >&2 + echo "with 'git rebase --signoff $BASE_SHA' and force-push." >&2 + fi exit "$missing" history-secret-scan: