From 639edaff0faba7ef04f54a7ed8de81f2c443489d Mon Sep 17 00:00:00 2001 From: Giovanny Rodriguez Date: Tue, 13 Oct 2026 12:29:36 -0500 Subject: [PATCH] fix(ci): run the DCO checker from the base branch The DCO job checked out the PR head and ran check_dco.py from it, which failed for branches created before the script existed (PR #7) and let a PR edit the checker to pass. Check out the base commit instead and fetch the PR commits by ref. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Giovanny Rodriguez --- .github/workflows/dco.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dco.yaml b/.github/workflows/dco.yaml index fabc990..a712cf0 100644 --- a/.github/workflows/dco.yaml +++ b/.github/workflows/dco.yaml @@ -10,10 +10,15 @@ jobs: dco: runs-on: ubuntu-latest steps: + # Run the checker from the base branch, never from the PR itself: + # a PR could otherwise edit check_dco.py to pass. - uses: actions/checkout@v4 with: + ref: ${{ github.event.pull_request.base.sha }} fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} + + - name: Fetch the pull request commits + run: git fetch --no-tags origin "refs/pull/${{ github.event.pull_request.number }}/head" - name: Check sign-off on every commit run: |