ci: require a Signed-off-by on every commit in a pull request

[Minipada]

Closes #303

What I did

The premise of the issue turned out to be half wrong, so this PR adds no new checker.

The repo already had a DCO check. The probot DCO app is installed and posts a DCO check run on every pull request — green on #353, so it predates this work. It already covered three of the four acceptance criteria: it fails an unsigned PR, it names the offending commits, and it only looks at the commits the PR adds. What was missing was everything in the tree — no DCO text, no git commit -s in the contributing guide — plus enforcement, since jazzy had no branch protection and no rulesets at all, so the check reported an unsigned PR and the merge went through anyway.

What shipped:

• DCO at the repo root — verbatim v1.1 text from developercertificate.org, so the sign-off points at a file in the tree rather than a URL that can change under the project.
• doc/src/dc/contributing.md — "Signing off your commits": what the trailer certifies, that it has to match user.name/user.email, git commit -s, git commit --amend -s --no-edit, git rebase --signoff origin/jazzy + --force-with-lease, and a one-liner for a pre-push eyeball:

  git log --no-merges --format='%h %s → %(trailers:key=Signed-off-by,valueonly,separator=%x2C%x20)' origin/jazzy..HEAD

  An empty right-hand side is a commit with no sign-off. Matching checklist item in .github/PULL_REQUEST_TEMPLATE.md.
• Branch protection on jazzy — DCO is now its one required status check (pinned to the app), with enforce_admins: false so maintainer pushes to the branch still work, and force-pushes and deletions disabled.

How I did it

Two attempts at an in-repo checker were written and then deleted along the way (the branch is squashed to one commit, so they are recorded in progress.txt rather than in history):

1. .github/workflows/dco.yaml running a script over base.sha..head.sha. It went green on real CI (job "Sign-off") and was removed once the app was found — two identical gates on every PR is noise, and it was the weaker of the two: it only required a well-formed trailer to be present, where the app requires it to match the commit author.
2. tools/ci/dco_check.sh, kept briefly as the local half. Also removed: with no job running it, it was a hand-reimplementation of a rule it could never be verified against, and its failure mode is the bad one — drift toward leniency means it passes locally while the app fails, which is worse than no local check. A documented one-liner does the same job with nothing to maintain.

Two traps worth recording (both are in progress.txt, since any future in-repo git-message check walks into them):

• git show -s --format=%B "$sha" | grep -Eiq … is wrong under set -o pipefail. grep -q exits at the first match, git takes SIGPIPE, the pipeline reports 141, and a signed commit reads as unsigned — intermittently, and only for long messages.
• while read … < <(git rev-list "$RANGE") swallows an unresolvable range and then reports "every commit is signed off" over a list it never read.

How I tested

The deleted script was tested against throwaway repos with core.hooksPath pointed at nothing, so the sign-off wasn't added behind the test's back — this machine has a global prepare-commit-msg hook that signs every commit, which silently made the first two attempts at that test pass for the wrong reason. Missing trailer, sign-off by a different identity, lowercase signed-off-by: with a case-differing address, a trailer under a body and a Co-Authored-By: line, author ≠ committer signed by the committer, two trailers where one matches, an unsigned merge commit and a nonexistent range all behaved correctly before it was removed.

The one-liner that replaced it was run against the same repos: unsigned, wrong-identity and correctly-signed commits are distinguishable at a glance. On the previous head every check was green — required DCO, Format, build, build-workspace, build-e2e-image, e2e, sim, codecov — and prek run --all-files --skip build-doc passes.

Types of changes

• Other (repo policy: DCO text, docs, branch protection)

I'm not a dummy, so I've checked these

• 📑 I documented correctly following our guidelines
• 💯 I tested locally and it is working
• 🟢 My code does not fail neither code linting checks nor unit test.
• ✍️ Every commit is signed off (git commit -s)

🤖 Generated with Claude Code

https://claude.ai/code/session_01PUmx6UnU9fuPLg5q385pG2

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.54%. Comparing base (1f77002) to head (48f983b).

Additional details and impacted files

@@           Coverage Diff           @@
##            jazzy     #355   +/-   ##
=======================================
  Coverage   67.54%   67.54%           
=======================================
  Files          95       95           
  Lines        5884     5884           
=======================================
  Hits         3974     3974           
  Misses       1910     1910           

Flag	Coverage Δ
cpp-jazzy	67.54% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Minipada]

Closing unmerged — the repo already had the DCO check this PR set out to add.

The probot DCO app is installed and posts the required DCO check on every pull request, so the workflow and the local script written here were both redundant and were deleted during review. What remained was a DCO text file and documentation, judged not worth the footprint.

The one thing that was missing — enforcement — is already done and does not depend on this PR: jazzy now requires the DCO check, with enforce_admins: false and force-pushes/deletions disabled. Closing this changes none of that.

See #303 for the full record. The branch is kept, so the history (workflow, local check, and the reasons each went) is recoverable if it is ever wanted.