Add DCO check workflow for pull requests - #38
Merged
Conversation
CONTRIBUTING.md requires every commit to carry a Signed-off-by trailer, but enforcement was honor-system — recent PRs (NVIDIA#29, NVIDIA#30, NVIDIA#32) merged via --admin override because contributors forgot the sign-off and there was no automated check. This workflow runs on every pull_request open/synchronize/reopen, walks each commit in base..head, and fails if any commit lacks a Signed-off-by trailer. The failure log surfaces the recovery command (git rebase --signoff origin/main && git push --force-with-lease) so contributors can self-serve. The automated/sync-skills branch is exempt — it's the daily mirror bot, not a contributor; the legal anchor for synced content lives on the human onboarding PR that registered the component in components.yml. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Sayali Kandarkar <skandarkar@nvidia.com>
sayalinvidia
marked this pull request as ready for review
April 30, 2026 23:12
mosheabr
approved these changes
May 1, 2026
mosheabr
left a comment
mosheabr
left a comment
Collaborator
There was a problem hiding this comment.
Approve.
DCO workflow walks base..head with native git trailer extraction (git show --format='%(trailers:key=Signed-off-by,valueonly)'), surfaces the rebase --signoff recovery command in the failure log, and exempts automated/sync-skills as discussed. Least-privilege permissions. Closes the honor-system gap that's been forcing --admin overrides on recent PRs (#29, #30, #32).
This was referenced May 1, 2026
Merged
sayalinvidia
pushed a commit
that referenced
this pull request
May 5, 2026
The DCO check (#38) verifies every commit carries a Signed-off-by trailer but doesn't validate that the author email matches an NVIDIA-affiliated address. Catalog content is published externally under NVIDIA's name — accepting commits from arbitrary personal/ external email addresses creates IP-traceability gaps that are hard to clean up after the fact. PR #47 surfaced this gap concretely: an external contributor opened a catalog onboarding PR with commits authored from gmail.com and eduquencher.com addresses. Detection happened during human review only; this workflow makes it an automated gate. The check walks every non-merge commit between base and head, and fails if any commit's author OR committer email isn't @nvidia.com or @users.noreply.github.com (github-noreply covers NVIDIA-org members who hide their personal email). The automated/sync-skills branch is exempt — same rationale as the DCO check, it's the bot mirror, not a contributor. Companion change: catalog-pr-reviewer skill updated with the same check inline so reviewers see the violation locally before opening the PR rather than after CI fails. Signed-off-by: Moshe Abramovitch <moshea@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CONTRIBUTING.md requires every commit to carry a Signed-off-by trailer, but enforcement was honor-system — recent PRs (#29, #30, #32) merged via --admin override because contributors forgot the sign-off and there was no automated check.
This workflow runs on every pull_request open/synchronize/reopen, walks each commit in base..head, and fails if any commit lacks a Signed-off-by trailer. The failure log surfaces the recovery command (git rebase --signoff origin/main && git push --force-with-lease) so contributors can self-serve.
The automated/sync-skills branch is exempt — it's the daily mirror bot, not a contributor; the legal anchor for synced content lives on the human onboarding PR that registered the component in components.yml.
Onboarding type
components.ymlentry)For new product onboarding — author affirmations
By submitting this PR, I confirm on behalf of my team:
.agents/skills/orskills/path used for new entries (or existing path retained for legacy entries percomponents.yml)Reviewer checklist (OSS Skills PIC)
components.ymlentry valid (required fields, uniquecatalog_dir, path exists in source repo)SKILL.mdfrontmatter spec-compliant (at least one sampled)All PRs
git commit -s).If you forgot, run
git rebase --signoff origin/main && git push --force-with-leaseto retroactively sign all commits in your branch.Other context (for non-onboarding PRs)