You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Ensure the recent commit messages have Signed-off-by headers. We
103
-
# only need to check the HEAD commit because all commits are tested
104
-
# in CI. Unclear why git log outputs blank lines when parsing trailers
105
-
# in this way, but we remove those blank lines so as not to skew the
106
-
# count of the trailers we are searching for.
107
-
#
108
-
# TODO: Remove once this is enforced for admins too;
109
-
# see https://bugs.chromium.org/p/gerrit/issues/detail?id=15229
110
-
if [[ "$(git log -1 --pretty='%(trailers:key=Signed-off-by)' | sed '/^\s*$/d' | wc -l)" -eq 0 ]]; then
111
-
echo -e "\nRecent commit is lacking Signed-off-by:\n"
112
-
git show --quiet
113
-
exit 1
114
-
fi
115
-
116
93
# Ensure that commit messages have a blank second line.
117
94
# We know that a commit message must be longer than a single
118
95
# line because each commit must be signed-off.
@@ -121,34 +98,32 @@ jobs:
121
98
exit 1
122
99
fi
123
100
124
-
# Ensure that the commit author is the same as the signed-off-by. This
125
-
# is a basic requirement of DCO. It is enforced by Gerrit (although
126
-
# noting that in Gerrit the author name does not have to match, only
127
-
# the email address), but _not_ by the DCO GitHub app:
101
+
# All authors, including co-authors, must have a signed-off trailer by email.
102
+
# Note that trailers are in the form "Name <email>", so grab the email with sed.
103
+
# For now, we require the sorted lists of author and signer emails to match.
104
+
# Note that this also fails if a commit isn't signed-off at all.
128
105
#
129
-
# https://github.com/dcoapp/app/issues/201
130
-
#
131
-
# Provide a sanity check as part of GitHub workflows that should enforce
132
-
# this, e.g. trybot workflows.
133
-
#
134
-
# We do so by comparing the commit author and "Signed-off-by" trailer for
135
-
# strict equality. Whilst this is more strict than Gerrit, it should
136
-
# generally be the case, and we can always relax this when presented with
137
-
# specific situations where it is is a problem.
138
-
139
-
# commit author email address
140
-
commitauthor="$(git log -1 --pretty="%ae")"
141
-
142
-
# signed-off-by trailer email address. There is no way to parse just the
143
-
# email address from the trailer in the same way as git log, so instead
144
-
# grab the relevant trailer and then take the last whitespace-delimited
145
-
# part as the "<>" contained email address.
146
-
# Getting the Signed-off-by trailer in this way causes blank
147
-
# lines for some reason. Use awk to remove them.
148
-
commitsigner="$(git log -1 --pretty='%(trailers:key=Signed-off-by,valueonly)' | sed -ne 's/.* <\(.*\)>/\1/p')"
149
-
150
-
if [[ "$commitauthor" != "$commitsigner" ]]; then
151
-
echo "commit author email address does not match signed-off-by trailer"
106
+
# In Gerrit we already enable a form of this via https://gerrit-review.googlesource.com/Documentation/project-configuration.html#require-signed-off-by,
107
+
# but it does not support co-authors nor can it be used when testing GitHub PRs.
108
+
commit_authors="$(
109
+
{
110
+
git log -1 --pretty='%ae'
111
+
git log -1 --pretty='%(trailers:key=Co-authored-by,valueonly)' | sed -ne 's/.* <\(.*\)>/\1/p'
112
+
} | sort -u
113
+
)"
114
+
commit_signers="$(
115
+
{
116
+
git log -1 --pretty='%(trailers:key=Signed-off-by,valueonly)' | sed -ne 's/.* <\(.*\)>/\1/p'
117
+
} | sort -u
118
+
)"
119
+
if [[ "${commit_authors}" != "${commit_signers}" ]]; then
120
+
echo "Error: commit author email addresses do not match signed-off-by trailers"
121
+
echo
122
+
echo "Authors:"
123
+
echo "${commit_authors}"
124
+
echo
125
+
echo "Signers:"
126
+
echo "${commit_signers}"
152
127
exit 1
153
128
fi
154
129
- name: Generate
@@ -157,5 +132,6 @@ jobs:
157
132
run: go test ./...
158
133
- name: Check
159
134
run: go vet ./...
160
-
- name: Check that git is clean at the end of the job
135
+
- if: always()
136
+
name: Check that git is clean at the end of the job
161
137
run: test -z "$(git status --porcelain)" || (git status; git diff; false)
echo "\(_dispatchTrailerVariable) contains \(dispatchTrailer) but we are on a protected branch"
103
95
false
104
96
"""
105
97
},
@@ -109,20 +101,6 @@ checkoutCode: {
109
101
earlyChecks: json.#step& {
110
102
name: "Early git and code sanity checks"
111
103
run: #"""
112
-
# Ensure the recent commit messages have Signed-off-by headers. We
113
-
# only need to check the HEAD commit because all commits are tested
114
-
# in CI. Unclear why git log outputs blank lines when parsing trailers
115
-
# in this way, but we remove those blank lines so as not to skew the
116
-
# count of the trailers we are searching for.
117
-
#
118
-
# TODO: Remove once this is enforced for admins too;
119
-
# see https://bugs.chromium.org/p/gerrit/issues/detail?id=15229
120
-
if [[ "$(git log -1 --pretty='%(trailers:key=Signed-off-by)' | sed '/^\s*$/d' | wc -l)" -eq 0 ]]; then
121
-
echo -e "\nRecent commit is lacking Signed-off-by:\n"
122
-
git show --quiet
123
-
exit 1
124
-
fi
125
-
126
104
# Ensure that commit messages have a blank second line.
127
105
# We know that a commit message must be longer than a single
128
106
# line because each commit must be signed-off.
@@ -131,34 +109,32 @@ earlyChecks: json.#step & {
131
109
exit 1
132
110
fi
133
111
134
-
# Ensure that the commit author is the same as the signed-off-by. This
135
-
# is a basic requirement of DCO. It is enforced by Gerrit (although
136
-
# noting that in Gerrit the author name does not have to match, only
137
-
# the email address), but _not_ by the DCO GitHub app:
138
-
#
139
-
# https://github.com/dcoapp/app/issues/201
140
-
#
141
-
# Provide a sanity check as part of GitHub workflows that should enforce
142
-
# this, e.g. trybot workflows.
112
+
# All authors, including co-authors, must have a signed-off trailer by email.
113
+
# Note that trailers are in the form "Name <email>", so grab the email with sed.
114
+
# For now, we require the sorted lists of author and signer emails to match.
115
+
# Note that this also fails if a commit isn't signed-off at all.
143
116
#
144
-
# We do so by comparing the commit author and "Signed-off-by" trailer for
145
-
# strict equality. Whilst this is more strict than Gerrit, it should
146
-
# generally be the case, and we can always relax this when presented with
147
-
# specific situations where it is is a problem.
148
-
149
-
# commit author email address
150
-
commitauthor="$(git log -1 --pretty="%ae")"
151
-
152
-
# signed-off-by trailer email address. There is no way to parse just the
153
-
# email address from the trailer in the same way as git log, so instead
154
-
# grab the relevant trailer and then take the last whitespace-delimited
155
-
# part as the "<>" contained email address.
156
-
# Getting the Signed-off-by trailer in this way causes blank
157
-
# lines for some reason. Use awk to remove them.
158
-
commitsigner="$(git log -1 --pretty='%(trailers:key=Signed-off-by,valueonly)' | sed -ne 's/.* <\(.*\)>/\1/p')"
159
-
160
-
if [[ "$commitauthor" != "$commitsigner" ]]; then
161
-
echo "commit author email address does not match signed-off-by trailer"
117
+
# In Gerrit we already enable a form of this via https://gerrit-review.googlesource.com/Documentation/project-configuration.html#require-signed-off-by,
118
+
# but it does not support co-authors nor can it be used when testing GitHub PRs.
119
+
commit_authors="$(
120
+
{
121
+
git log -1 --pretty='%ae'
122
+
git log -1 --pretty='%(trailers:key=Co-authored-by,valueonly)' | sed -ne 's/.* <\(.*\)>/\1/p'
123
+
} | sort -u
124
+
)"
125
+
commit_signers="$(
126
+
{
127
+
git log -1 --pretty='%(trailers:key=Signed-off-by,valueonly)' | sed -ne 's/.* <\(.*\)>/\1/p'
128
+
} | sort -u
129
+
)"
130
+
if [[ "${commit_authors}" != "${commit_signers}" ]]; then
131
+
echo "Error: commit author email addresses do not match signed-off-by trailers"
132
+
echo
133
+
echo "Authors:"
134
+
echo "${commit_authors}"
135
+
echo
136
+
echo "Signers:"
137
+
echo "${commit_signers}"
162
138
exit 1
163
139
fi
164
140
"""#
@@ -239,7 +215,7 @@ setupGoActionsCaches: {
239
215
if!#readonly {
240
216
cacheStep& {
241
217
if: readWriteCacheExpr
242
-
uses: "actions/cache@v3"
218
+
uses: "actions/cache@v4"
243
219
}
244
220
},
245
221
@@ -252,7 +228,7 @@ setupGoActionsCaches: {
252
228
if: "! \(readWriteCacheExpr)"
253
229
}
254
230
255
-
uses: "actions/cache/restore@v3"
231
+
uses: "actions/cache/restore@v4"
256
232
},
257
233
258
234
if#cleanTestCache {
@@ -278,7 +254,7 @@ setupGoActionsCaches: {
278
254
// but array literals are not yet supported in expressions.
0 commit comments