Package: dco-check
dco-checkSimple DCO check script to be used inany CI.MotivationMany open-source projects require the use of aSigned-off-by:line in every commit message.
This is to certify that a contributor has the right to submit their code according to theDeveloper Certificate of Origin (DCO).
However, to my knowledge, there is no automated check that can run on any CI platform (or most platforms).
Some platforms simply do not possess such a feature.This was inspired by theDCO GitHub App.How to get & useThere are a few options:Using thepackage from PyPI$pipinstalldco-check
$dco-checkUsing the Docker image (christophebedard/dco-check) with your CI (seeexamples)$dco-checkDownloading the script and running it (you can replacemasterwith a specific version)This is enabled by the fact thatdco-checkis a single Python file without any third-party dependencies.$wgethttps://raw.githubusercontent.com/christophebedard/dco-check/master/dco_check/dco_check.py
$python3dco_check.pyIt exits with 0 if all checked commits have been signed-off.
Otherwise, it exits with a non-zero number.Run with--helpfor more information and options, including:ignoring merge commitsdefault branchdefault remotelist of commit author emails to exclude from checksregular expression pattern to exclude generic emails when matchedquiet modeverbose modeexcluding certain author emails (e.g., for bots)Those options can alternatively be set through environment variables (see--help), but commandline arguments always have precedence over environment variables.How it worksdco-checkfocuses on two use-cases:Commits part of a feature branch, i.e. a proposed change (pull request or merge request)Commits on the default branch, e.g.master, or more specifically the new commits pushed to the default branchThe first use-case is easy to cover given a normal git repository.
We can simply usegit merge-base --fork-point $DEFAULT_BRANCHto get the list of commits on a specific feature branch off of the default branch.
Some CIs provide even more information, such as the target branch of the change, which is useful if we don't expect to always target the default branch.
Then we can just check every commit usinggit logand make sure it is signed-off by the author.The second use-case isn't really possible with simple git repositories, because they do not contain the necessary information (AFAIK).
Fortunately, some CIs do provide this information.Furthermore, by default, some CI platforms only clone git repositories up to a specific depth, i.e. you only get a partial commit history.
This depth can sometimes be 1 for some CIs, i.e. a shallow clone.
For those cases, it is usually possible to prevent shallow cloning by setting the right parameter(s) in the job configuration.
However, since one of the goals ofdco-checkis to be as easy to use as possible, it tries not to rely on that.This is whydco-checkdetects the current CI platform and uses whatever information that platform can provide.
Otherwise, it falls back on a default generic implementation which uses simple git commands.
In those cases, the CLI options allow users to provide a lot of the missing information.CI supportBelow is a summary of the supported CIs along with their known behaviours.CIDetects new changes when pushing to default branchDetects PRs/MRsGets base branch usingGets default branch usingNotesGitHub✓✓CI(not used)retrieves commit data using the GitHub API, since GitHub does shallow clones by defaultGitLab✓✓CICIdetects normal GitLab MRs and external (GitHub) MRsAzure Pipelines✓CICLI argumentsAppVeyor✓CICLI argumentsCircleCI✓CI* (or CLI arguments)CLI arguments*can use base revision information if provided (see example)Travis CICLI argumentsCLI argumentssupported by default as a normal git repodefault (git)CLI argumentsCLI argumentsuse locally; using in an unsupported CI which only does a shallow clone might cause problemsExample CI configurationsHere are some example CI configurations.GitHub# .github/workflows/dco.ymlname:DCOon:pull_request:push:branches:-masterjobs:check:runs-on:ubuntu-lateststeps:-uses:actions/checkout@v3-name:Set up Python 3.xuses:actions/setup-python@v4with:python-version:'3.x'-name:Check DCOenv:GITHUB_TOKEN:${{ secrets.GITHUB_TOKEN }}run:|pip3 install -U dco-checkdco-checkGitLab# .gitlab-ci.ymlvariables:DOCKER_DRIVER:overlay2dco:image:christophebedard/dco-check:latestrules:-if:$CI_MERGE_REQUEST_ID-if:$CI_EXTERNAL_PULL_REQUEST_IID-if:$CI_COMMIT_BRANCH == 'master'script:-pip3 install -U dco-check# optional-dco-checkPython version supportPython 3.6+ is required because of the use of f-strings.
However, it shouldn't be too hard to remove them to support older versions of Python 3, if there is a demand for it, or if such a change is contributed todco-check.ContributingSeeCONTRIBUTING.md.