From 86e757d17b9f7aaa10ed402c5822e09830c164fe Mon Sep 17 00:00:00 2001 From: kperry Date: Thu, 16 Jul 2026 14:30:55 -0500 Subject: [PATCH 1/5] build: enforce DCO sign-off on pull requests Add a DCO status check requiring every human-authored commit to carry a Signed-off-by trailer matching the commit author or committer, certifying https://developercertificate.org. Bot-opened PRs (Dependabot, release-please) are exempt and merge commits are skipped. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 Signed-off-by: kperry --- .github/workflows/dco.yml | 59 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 .github/workflows/dco.yml diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml new file mode 100644 index 0000000..4974a2c --- /dev/null +++ b/.github/workflows/dco.yml @@ -0,0 +1,59 @@ +name: DCO + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + +jobs: + dco: + name: DCO + # Bot-opened PRs (Dependabot, release-please) are exempt: bots cannot + # certify the DCO. A skipped job still satisfies a required status check. + if: ${{ !endsWith(github.event.pull_request.user.login, '[bot]') }} + runs-on: ubuntu-latest + steps: + - name: Verify Signed-off-by on every commit + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + PR: ${{ github.event.pull_request.number }} + run: | + set -euo pipefail + bad=0 + # Merge commits and bot-authored commits are skipped; every other + # commit needs a Signed-off-by trailer whose email matches the + # commit author or committer (Developer Certificate of Origin). + for row in $(gh api "repos/${REPO}/pulls/${PR}/commits" --paginate \ + --jq '.[] | select((.parents | length) < 2) | select(((.author.login // "") | endswith("[bot]")) | not) | @base64'); do + field() { echo "$row" | base64 -d | jq -r "$1"; } + sha=$(field '.sha') + author_email=$(field '.commit.author.email' | tr '[:upper:]' '[:lower:]') + committer_email=$(field '.commit.committer.email' | tr '[:upper:]' '[:lower:]') + signoff_emails=$(field '.commit.message' \ + | grep -E '^Signed-off-by: .+ <[^<>@ ]+@[^<>@ ]+>$' \ + | sed -E 's/.*<([^<>]+)>.*/\1/' \ + | tr '[:upper:]' '[:lower:]' || true) + ok=0 + for email in $signoff_emails; do + if [ "$email" = "$author_email" ] || [ "$email" = "$committer_email" ]; then + ok=1 + fi + done + if [ "$ok" -ne 1 ]; then + echo "::error::commit ${sha} has no Signed-off-by matching its author or committer (${author_email})" + bad=1 + fi + done + if [ "$bad" -ne 0 ]; then + echo "" + echo "One or more commits lack a valid DCO sign-off." + echo "Certify the Developer Certificate of Origin (https://developercertificate.org)" + echo "by signing each commit:" + echo " new commits: git commit -s" + echo " existing commits: git rebase --signoff origin/main && git push --force-with-lease" + exit 1 + fi + echo "All commits carry a valid Signed-off-by." From 9212ace30d6c2bc2a4dd439ab235fe5b0867a55a Mon Sep 17 00:00:00 2001 From: kperry Date: Thu, 16 Jul 2026 14:37:08 -0500 Subject: [PATCH 2/5] docs: document DCO, AI disclosure, and issue linking in CONTRIBUTING Add Developer Certificate of Origin, AI-Assisted Contributions, and Linking Issues sections to the contributing guide, matching the org-wide PR template and the DCO check introduced on this branch. Also fix stale godaddy/* repository links left over from the repo move. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 Signed-off-by: kperry --- CONTRIBUTING.md | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c27a003..553e5ee 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -65,7 +65,7 @@ contributors about the change, discuss the best way to go about implementing it. > pull requests from branches on your fork. To do this, run: > > ``` -> git remote add upstream https://github.com/godaddy/ans-sdk-java.git +> git remote add upstream https://github.com/agentnameservice/ans-sdk-java.git > git fetch upstream > git branch --set-upstream-to=upstream/main main > ``` @@ -134,11 +134,45 @@ Generally speaking, Git handles attribution automatically. Ensure that your contribution follows the standards set by the project's style guide with respect to patterns, naming, documentation and testing. +## Developer Certificate of Origin + +This project follows the Linux Foundation contribution model. Every commit +must carry a `Signed-off-by:` trailer certifying the +[Developer Certificate of Origin](https://developercertificate.org) — your +assertion that you have the right to submit the change under the project's +license. Sign off each commit with: + +``` +git commit -s +``` + +Missing sign-offs on an existing branch can be fixed with +`git rebase --signoff origin/main` followed by a force-push. The `DCO` +status check enforces this on every pull request; PRs opened by bots +(Dependabot, release-please) are exempt, and merge commits are skipped. + +## AI-Assisted Contributions + +AI-assisted contributions are welcome **with disclosure**, following the +[Linux kernel convention](https://docs.kernel.org/process/coding-assistants.html): + +- Disclose the tooling in the pull request's **AI assistance** section, + naming the tool and model, e.g. `Assisted-by: Claude Code (claude-fable-5)`. +- AI tools must never add `Signed-off-by:` lines. DCO certification belongs + to the human submitter, who remains fully responsible for the correctness + and licensing of the contribution. + +## Linking Issues + +Every pull request must reference an issue with a closing keyword (e.g. +`Fixes #123`). Open the issue first — issues are where triage and +prioritization happen. + # Additional Resources - [General GitHub Documentation](https://help.github.com/) - [GitHub Pull Request documentation](https://help.github.com/send-pull-requests/) -[issues]: https://github.com/godaddy/ans-sdk-java/issues +[issues]: https://github.com/agentnameservice/ans-sdk-java/issues [coc]: ./CODE_OF_CONDUCT.md [fork]: https://help.github.com/en/articles/fork-a-repo From 7ed1ec968238531d76bffc36afb9c759f311153e Mon Sep 17 00:00:00 2001 From: kperry Date: Thu, 16 Jul 2026 14:52:32 -0500 Subject: [PATCH 3/5] build: call the org-shared DCO reusable workflow Replace the inlined check with a thin caller of agentnameservice/.github/.github/workflows/dco-check.yml@main so the policy is maintained in one place. This check errors until agentnameservice/.github#6 merges (merge that first). Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 Signed-off-by: kperry --- .github/workflows/dco.yml | 51 +++------------------------------------ 1 file changed, 4 insertions(+), 47 deletions(-) diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml index 4974a2c..026e0c8 100644 --- a/.github/workflows/dco.yml +++ b/.github/workflows/dco.yml @@ -1,5 +1,8 @@ name: DCO +# Thin caller: the actual check lives in the org-shared reusable workflow +# at agentnameservice/.github — fix or extend the policy there, not here. + on: pull_request: types: [opened, synchronize, reopened] @@ -10,50 +13,4 @@ permissions: jobs: dco: name: DCO - # Bot-opened PRs (Dependabot, release-please) are exempt: bots cannot - # certify the DCO. A skipped job still satisfies a required status check. - if: ${{ !endsWith(github.event.pull_request.user.login, '[bot]') }} - runs-on: ubuntu-latest - steps: - - name: Verify Signed-off-by on every commit - env: - GH_TOKEN: ${{ github.token }} - REPO: ${{ github.repository }} - PR: ${{ github.event.pull_request.number }} - run: | - set -euo pipefail - bad=0 - # Merge commits and bot-authored commits are skipped; every other - # commit needs a Signed-off-by trailer whose email matches the - # commit author or committer (Developer Certificate of Origin). - for row in $(gh api "repos/${REPO}/pulls/${PR}/commits" --paginate \ - --jq '.[] | select((.parents | length) < 2) | select(((.author.login // "") | endswith("[bot]")) | not) | @base64'); do - field() { echo "$row" | base64 -d | jq -r "$1"; } - sha=$(field '.sha') - author_email=$(field '.commit.author.email' | tr '[:upper:]' '[:lower:]') - committer_email=$(field '.commit.committer.email' | tr '[:upper:]' '[:lower:]') - signoff_emails=$(field '.commit.message' \ - | grep -E '^Signed-off-by: .+ <[^<>@ ]+@[^<>@ ]+>$' \ - | sed -E 's/.*<([^<>]+)>.*/\1/' \ - | tr '[:upper:]' '[:lower:]' || true) - ok=0 - for email in $signoff_emails; do - if [ "$email" = "$author_email" ] || [ "$email" = "$committer_email" ]; then - ok=1 - fi - done - if [ "$ok" -ne 1 ]; then - echo "::error::commit ${sha} has no Signed-off-by matching its author or committer (${author_email})" - bad=1 - fi - done - if [ "$bad" -ne 0 ]; then - echo "" - echo "One or more commits lack a valid DCO sign-off." - echo "Certify the Developer Certificate of Origin (https://developercertificate.org)" - echo "by signing each commit:" - echo " new commits: git commit -s" - echo " existing commits: git rebase --signoff origin/main && git push --force-with-lease" - exit 1 - fi - echo "All commits carry a valid Signed-off-by." + uses: agentnameservice/.github/.github/workflows/dco-check.yml@main From 5e99f4debfb1f0a6ffca28d7f907282ed3630654 Mon Sep 17 00:00:00 2001 From: kperry Date: Thu, 16 Jul 2026 14:59:14 -0500 Subject: [PATCH 4/5] build: use the org-wide DCO app instead of a per-repo workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DCO enforcement moves to https://github.com/apps/dco — the standard across Linux Foundation projects — which validates sign-offs per commit and exempts bot-authored commits and merges by default. Drop the Actions workflow and point CONTRIBUTING at the app. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 Signed-off-by: kperry --- .github/workflows/dco.yml | 16 ---------------- CONTRIBUTING.md | 6 ++++-- 2 files changed, 4 insertions(+), 18 deletions(-) delete mode 100644 .github/workflows/dco.yml diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml deleted file mode 100644 index 026e0c8..0000000 --- a/.github/workflows/dco.yml +++ /dev/null @@ -1,16 +0,0 @@ -name: DCO - -# Thin caller: the actual check lives in the org-shared reusable workflow -# at agentnameservice/.github — fix or extend the policy there, not here. - -on: - pull_request: - types: [opened, synchronize, reopened] - -permissions: - contents: read - -jobs: - dco: - name: DCO - uses: agentnameservice/.github/.github/workflows/dco-check.yml@main diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 553e5ee..fa85c74 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -148,8 +148,10 @@ git commit -s Missing sign-offs on an existing branch can be fixed with `git rebase --signoff origin/main` followed by a force-push. The `DCO` -status check enforces this on every pull request; PRs opened by bots -(Dependabot, release-please) are exempt, and merge commits are skipped. +status check — the org-wide [DCO app](https://github.com/apps/dco), the +same enforcement used across Linux Foundation projects — validates this +on every pull request; bot-authored commits (Dependabot, release-please) +and merge commits are exempt. ## AI-Assisted Contributions From c67b5acee2cd1b196ea3233b65df73be20ffa0b6 Mon Sep 17 00:00:00 2001 From: kperry Date: Thu, 16 Jul 2026 15:39:17 -0500 Subject: [PATCH 5/5] chore: trigger DCO evaluation Empty commit; the hosted DCO app missed this PR's reopen event, and a push reliably delivers a fresh pull_request synchronize event. Assisted-by: Claude Code (claude-fable-5) Co-Authored-By: Claude Fable 5 Signed-off-by: kperry