Add DCO check workflow for pull requests

.github/workflows/dco.yml

@@ -0,0 +1,67 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2026 NVIDIA Corporation. All rights reserved.
+#
+# Verify every commit in a pull request carries a Signed-off-by
+# trailer per the project's DCO requirement (see CONTRIBUTING.md).
+#
+# The automated/sync-skills branch is exempt — it's the daily mirror
+# bot, not a contributor. The legal anchor for synced content lives
+# on the human onboarding PR that registered the component in
+# components.yml; the daily sync is downstream plumbing.
+
+name: DCO Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  dco:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout PR branch with full history
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Verify DCO sign-off on every commit
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+        run: |
+          set -euo pipefail
+
+          # Bot-managed sync branch is exempt — see header comment.
+          if [ "$HEAD_REF" = "automated/sync-skills" ]; then
+            echo "DCO check exempt for bot-managed branch '$HEAD_REF'."
+            exit 0
+          fi
+
+          unsigned=()
+          while read -r sha; do
+            if ! git show --format='%(trailers:key=Signed-off-by,valueonly)' -s "$sha" | grep -q .; then
+              subject=$(git show --format='%s' -s "$sha")
+              unsigned+=("$sha $subject")
+            fi
+          done < <(git log --no-merges --format='%H' "$BASE_SHA..$HEAD_SHA")
+
+          if [ ${#unsigned[@]} -gt 0 ]; then
+            echo "::error::Some commits in this PR are missing a Signed-off-by trailer."
+            echo ""
+            echo "Unsigned commits:"
+            printf '  %s\n' "${unsigned[@]}"
+            echo ""
+            echo "To fix, run on your branch:"
+            echo ""
+            echo "  git rebase --signoff origin/main && git push --force-with-lease"
+            echo ""
+            echo "See CONTRIBUTING.md for the full DCO requirement."
+            exit 1
+          fi
+
+          echo "All commits signed off."