ci: add DCO check, Mergify automation, and branch naming enforcement

.github/mergify.yml

@@ -0,0 +1,78 @@
+pull_request_rules:
+  - name: Enforce branch naming convention
+    description: Branch must follow <type>/<description> or <username>/<description> format
+    conditions:
+      - head ~!= ^[a-z0-9]([a-z0-9._-]*[a-z0-9])?/[a-z0-9._-]+$
+      - head != main
+    actions:
+      comment:
+        message: |
+          Hi @{{author}}, the branch `{{head}}` does not follow our naming convention.
+
+          Please use one of the following formats:
+          - `<type>/<description>` — e.g. `feat/add-auth`, `fix/null-pointer`
+          - `<username>/<description>` — e.g. `changsu/fix-routing`
+
+          Allowed types: `feat`, `fix`, `chore`, `docs`, `refactor`, `test`, `ci`, `perf`
+      post_check:
+        title: Branch naming convention
+        summary: |
+          Branch `{{head}}` does not match the required pattern: `<type>/<description>` or `<username>/<description>`.
+      close:
+        message: |
+          Closing this PR because the branch name does not follow the naming convention. Please rename your branch and reopen.
+
+  - name: Comment on DCO check failure
+    description: Post fix instructions when DCO sign-off is missing
+    conditions:
+      - check-failure = dco-check
+      - -closed
+      - -draft
+    actions:
+      comment:
+        message: |
+          Hi @{{author}}, the DCO sign-off check has failed. All commits must include a `Signed-off-by` line.
+
+          **To fix existing commits:**
+          ```bash
+          # Sign off the last N commits (replace N with the number of unsigned commits)
+          git rebase HEAD~N --signoff
+          git push --force-with-lease
+          ```
+
+          **To sign off future commits automatically:**
+          - Use `git commit -s` every time, or
+          - **VSCode**: enable `Git: Always Sign Off` in Settings
+          - **PyCharm**: enable `Sign-off commit` in the Commit tool window
+
+  - name: Notify on merge conflicts
+    description: Comment when a PR has merge conflicts
+    conditions:
+      - conflict
+      - -closed
+      - -draft
+    actions:
+      comment:
+        message: |
+          Hi @{{author}}, this PR has merge conflicts that must be resolved before it can be merged. Please rebase your branch:
+          ```bash
+          git fetch origin main
+          git rebase origin/main
+          # resolve any conflicts, then:
+          git push --force-with-lease
+          ```
+
+  - name: Remind on stale PRs
+    description: Comment and label PRs inactive for 14 days
+    conditions:
+      - updated-at < 14 days ago
+      - -merged
+      - -closed
+      - -draft
+    actions:
+      comment:
+        message: |
+          Hi @{{author}}, this PR has been inactive for 14 days. Please update it or close it if it's no longer needed.
+      label:
+        add:
+          - stale

.github/workflows/dco.yml

@@ -0,0 +1,28 @@
+name: DCO Check
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  dco-check:
+    runs-on: k8s-runner-cpu
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Get PR commits
+        id: get-commits
+        uses: tim-actions/get-pr-commits@v1.3.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check DCO sign-off
+        uses: tim-actions/dco@v1.1.0
+        with:
+          commits: ${{ steps.get-commits.outputs.commits }}

.pre-commit-config.yaml

@@ -52,6 +52,31 @@ repos:
         types: [rust]
         pass_filenames: false
 
+      - id: branch-name-check
+        name: Branch naming convention
+        description: Ensure branch name follows <type>/<desc> or <username>/<desc> format
+        entry: |
+          bash -c '
+            branch=$(git rev-parse --abbrev-ref HEAD)
+            if [[ "$branch" != "main" && ! "$branch" =~ ^[a-z0-9]([a-z0-9._-]*[a-z0-9])?/[a-z0-9._-]+$ ]]; then
+              echo "Branch \"$branch\" does not follow naming convention: <type>/<description> or <username>/<description>"
+              exit 1
+            fi
+          '
+        language: system
+        stages: [pre-push]
+        always_run: true
+        pass_filenames: false
+
+      - id: dco-check
+        name: DCO sign-off check
+        description: Check that the commit message contains a DCO sign-off
+        entry: |
+          bash -c 'grep -q "^Signed-off-by: .* <.*>$" "$1"' --
+        language: system
+        stages: [commit-msg]
+        always_run: true
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.15.0
     hooks:

docs/contributing/development.md

@@ -157,8 +157,22 @@ Python code in `e2e_test/`, `bindings/python/`, and `scripts/` is checked with
 ```bash
 pip install pre-commit
 pre-commit install
+pre-commit install --hook-type commit-msg  # enables DCO sign-off check
 ```
 
+### DCO Sign-Off
+
+All commits must include a `Signed-off-by` line ([Developer Certificate of Origin](https://developercertificate.org/)).
+Use the `-s` flag when committing:
+
+```bash
+git commit -s -m "feat: add new feature"
+```
+
+This adds a line like `Signed-off-by: Your Name <your@email.com>` using your
+`user.name` and `user.email` from git config. The pre-commit `commit-msg` hook
+and CI will both reject commits without it.
+
 To run checks manually:
 
 ```bash