# SPDX-License-Identifier: Apache-2.0
# Copyright (c) 2026 NVIDIA Corporation. All rights reserved.
#
# Verify every commit in a pull request carries a Signed-off-by
# trailer per the project's DCO requirement (see CONTRIBUTING.md).
#
# The automated/sync-skills branch is exempt — it's the daily mirror
# bot, not a contributor. The legal anchor for synced content lives
# on the human onboarding PR that registered the component in
# components.yml; the daily sync is downstream plumbing.

name: DCO Check

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read

jobs:
  dco:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout PR branch with full history
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Verify DCO sign-off on every commit
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          set -euo pipefail

          # Bot-managed sync branch is exempt — see header comment.
          if [ "$HEAD_REF" = "automated/sync-skills" ]; then
            echo "DCO check exempt for bot-managed branch '$HEAD_REF'."
            exit 0
          fi

          unsigned=()
          while read -r sha; do
            if ! git show --format='%(trailers:key=Signed-off-by,valueonly)' -s "$sha" | grep -q .; then
              subject=$(git show --format='%s' -s "$sha")
              unsigned+=("$sha $subject")
            fi
          done < <(git log --no-merges --format='%H' "$BASE_SHA..$HEAD_SHA")

          if [ ${#unsigned[@]} -gt 0 ]; then
            echo "::error::Some commits in this PR are missing a Signed-off-by trailer."
            echo ""
            echo "Unsigned commits:"
            printf '  %s\n' "${unsigned[@]}"
            echo ""
            echo "To fix, run on your branch:"
            echo ""
            echo "  git rebase --signoff origin/main && git push --force-with-lease"
            echo ""
            echo "See CONTRIBUTING.md for the full DCO requirement."
            exit 1
          fi

          echo "All commits signed off."
