dco

#!/bin/bash
# DCO sign-off check. Verifies every non-merge commit in a range carries a
# 'Signed-off-by:' trailer matching the commit author (name <email>).
# This is the homebaked replacement for the DCO GitHub App.
#
# Usage: ./dco [<range>]        (default: origin/master..HEAD)
set -u

range="${1:-origin/master..HEAD}"
fail=0
checked=0

while read -r sha; do
	[[ -z "$sha" ]] && continue
	# Skip merge commits (more than one parent) — sign-off lives on the real commits.
	if (( $(git rev-list --parents -n1 "$sha" | wc -w) > 2 )); then
		continue
	fi
	checked=$((checked + 1))

	author=$(git show -s --format='%an <%ae>' "$sha")
	short=$(git show -s --format='%h' "$sha")
	if ! git show -s --format='%(trailers:key=Signed-off-by,valueonly)' "$sha" \
		| grep -qxF "$author"; then
		echo "FAIL [$short]: missing 'Signed-off-by: $author'"
		fail=1
	fi
done < <(git rev-list "$range")

if [[ $fail -eq 0 ]]; then
	echo "ok: $checked commit(s) carry a matching DCO sign-off"
fi
exit $fail