name: DCO

on:
  pull_request:

permissions:
  contents: read

jobs:
  dco-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: false # DCO check only needs commit metadata, not submodules
      - name: Verify DCO sign-off on all commits in PR
        shell: bash
        env:
          DCO_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          DCO_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: scripts/lint.sh dco