From a029b77375661a5f48a66e9ecd9d631533ef74a8 Mon Sep 17 00:00:00 2001
From: Rhuan Barreto <rhuan@barreto.work>
Date: Mon, 27 Apr 2026 23:07:48 +0200
Subject: [PATCH 1/2] fix(ci): add DCO sign-off to release PR commits

The release workflow creates commits via simple-release-action which
doesn't support the --signoff flag. This adds a prepare-commit-msg
git hook before the action runs to append the Signed-off-by trailer
automatically. Also sets the DCO status check on the release PR
commit since the DCO workflow doesn't trigger (GITHUB_TOKEN pushes
don't cascade workflow events).

Signed-off-by: Rhuan Barreto <rhuan.barreto@gmail.com>
---
 .github/workflows/release.yml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8fdca477..7919acfc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -84,6 +84,20 @@ jobs:
           key: bun-packages-${{ runner.os }}-v1-${{ hashFiles('bun.lock') }}
       - name: Install dependencies
         run: bun install --frozen-lockfile
+      - name: Install DCO sign-off hook
+        run: |
+          mkdir -p .git/hooks
+          cat > .git/hooks/prepare-commit-msg << 'HOOK'
+          #!/bin/sh
+          # Append DCO Signed-off-by trailer to release commits
+          if ! grep -qi "^Signed-off-by:" "$1"; then
+            name=$(git config user.name)
+            email=$(git config user.email)
+            echo "" >> "$1"
+            echo "Signed-off-by: $name <$email>" >> "$1"
+          fi
+          HOOK
+          chmod +x .git/hooks/prepare-commit-msg
       - name: Create or update pull request
         uses: TrigenSoftware/simple-release-action@a796225481a62b5b46b37d4481ef7fb114a6d399 # v1
         with:
@@ -101,6 +115,22 @@ jobs:
             exit 0
           fi
 
+          # Verify DCO sign-off and set status
+          COMMIT_MSG=$(gh api repos/${{ github.repository }}/git/commits/$HEAD_SHA --jq '.message')
+          if echo "$COMMIT_MSG" | grep -qiE '^Signed-off-by: .+ <.+>'; then
+            DCO_STATE=success
+            DCO_DESC="All commits are signed off"
+          else
+            DCO_STATE=failure
+            DCO_DESC="Missing DCO Signed-off-by line"
+          fi
+
+          gh api repos/${{ github.repository }}/statuses/$HEAD_SHA \
+            -f state="$DCO_STATE" \
+            -f context="DCO Sign-off Check" \
+            -f description="$DCO_DESC" \
+            --silent
+
           gh workflow run code-pull-request.yml --ref release
           sleep 5
           RUN_ID=$(gh run list --branch release --workflow code-pull-request.yml --limit 1 --json databaseId --jq '.[0].databaseId')

From 0cb04ec379e9abba23e449b1b91839ecff207ba3 Mon Sep 17 00:00:00 2001
From: Rhuan Barreto <rhuan@barreto.work>
Date: Mon, 27 Apr 2026 23:22:37 +0200
Subject: [PATCH 2/2] fix(ci): skip merge commits in DCO sign-off check

GitHub's "Update branch" button creates merge commits without a
Signed-off-by trailer. These are platform-generated and should not
require DCO sign-off. Use `git rev-list --no-merges` to skip them.

Signed-off-by: Rhuan Barreto <rhuan.barreto@gmail.com>
---
 .github/workflows/dco.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index 937774b4..9eeb90cf 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -32,7 +32,7 @@ jobs:
           head="${{ github.event.pull_request.head.sha }}"
           failed=0
 
-          for sha in $(git rev-list "$base".."$head"); do
+          for sha in $(git rev-list --no-merges "$base".."$head"); do
             if ! git log -1 --format='%B' "$sha" | grep -qiE '^Signed-off-by: .+ <.+>'; then
               echo "::error::Commit $sha is missing a DCO Signed-off-by line."
               echo "  $(git log -1 --format='%s' "$sha")"