name: DCO Check

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  check:
    if: ${{ !github.event.pull_request.draft }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout commit logs
        run: |
          git init
          git fetch --filter=blob:none "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" "$GITHUB_BASE_REF" "$GITHUB_REF"
      - name: Check for DCO sign-offs
        shell: bash
        run: |
          status=0
          while read -r commit; do
              author="$(git show --no-patch --pretty='format:%an <%ae>' "$commit")"
              if ! git show --no-patch --pretty='format:%(trailers:key=Signed-off-by,valueonly)' "$commit" | grep -Fxq "$author"; then
                  if [ $status -eq 0 ]; then
                      echo "The following commits are missing a Developer Certificate of Origin sign-off;"
                      echo "see https://github.com/osandov/drgn/blob/main/CONTRIBUTING.rst#signing-off"
                      echo
                  fi
                  status=1
                  git show --no-patch "$commit"
              fi
          done < <(git rev-list --no-merges "FETCH_HEAD..$GITHUB_SHA")
          if [ $status -eq 0 ]; then
              echo "All commits have a Developer Certificate of Origin sign-off"
          fi
          exit $status
