From 7782a0373665b1f4dcdb946cf91ef7803a73bf42 Mon Sep 17 00:00:00 2001 From: onyks-os <129986281+onyks-os@users.noreply.github.com> Date: Sun, 27 Sep 2026 20:30:53 +0200 Subject: [PATCH] ci(dco): exempt Dependabot's commits from the sign-off check Dependabot cannot add a Signed-off-by line, so every one of its pull requests failed the check. Only its exact author identity is exempt; a maintainer still reviews and merges each pull request. Co-Authored-By: Claude Opus 5.5 Signed-off-by: onyks-os <129986281+onyks-os@users.noreply.github.com> --- .github/workflows/dco.yml | 5 +++++ CONTRIBUTING.md | 2 ++ 2 files changed, 7 insertions(+) diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml index d4585f2..852029a 100644 --- a/.github/workflows/dco.yml +++ b/.github/workflows/dco.yml @@ -30,6 +30,11 @@ jobs: while read -r sha; do [ -z "$sha" ] && continue author="$(git show -s --format='%an <%ae>' "$sha")" + # Dependabot cannot sign off. A maintainer reviews and merges its + # pull requests, and that merge is the human certification. + if [ "$author" = "dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>" ]; then + continue + fi if ! git show -s --format='%B' "$sha" | grep -qiF "Signed-off-by: $author"; then echo "::error::Commit $sha is missing 'Signed-off-by: $author'" failed=1 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1aa53bc..36b1bf4 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -182,6 +182,8 @@ git rebase --signoff HEAD~ ``` > Pull requests with unsigned commits will not be merged. The DCO check is enforced by CI. +> The one exception is Dependabot, which cannot sign off: its commits are exempt, and a maintainer +> reviews and merges each of its pull requests.
Full DCO text