docs: add Signed-off-by check for pull requests

[SToPire]

Add a dedicated GitHub Actions workflow to check all commits in a pull request for a valid Signed-off-by trailer and fail the check when any commit is missing it.

Also document that pull requests will be blocked until the missing Signed-off-by trailer is fixed.

Assisted-by: Codex (GPT 5.4)

[SToPire]

Seems the check works normally in this PR. For a blocked PR see [1].

[1] SToPire#3

[Copilot]

Pull request overview

This PR introduces automated enforcement of DCO-style Signed-off-by: trailers for pull requests, and updates the developer documentation to note that missing sign-offs will block PRs.

Changes:

• Add a new GitHub Actions workflow that inspects all PR commits for a Signed-off-by: line and fails the check if any are missing it.
• Add a merge-queue compatibility path for the workflow via a merge_group trigger.
• Update developer docs to explicitly state that PRs are blocked until missing sign-offs are fixed.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/developers.md	Documents that PRs are automatically checked for a valid Signed-off-by: trailer and blocked if missing.
.github/workflows/commit_signoff.yml	Adds an Actions workflow to validate sign-off trailers on PR commits and report results in the job summary.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The merge_group path is currently a no-op (it always exits successfully) so this workflow will report success in the merge queue even when a PR’s commits are missing a Signed-off-by trailer. If this check is marked as required for merge queue, that can effectively bypass the intended enforcement. Consider performing the same validation during merge_group (e.g., checkout the merge_group ref and validate commit messages in the head range), or remove merge_group from this workflow and ensure branch protection requires the pull_request run instead.

[Copilot]

The Signed-off-by detection regex will treat any line starting with “Signed-off-by:” anywhere in the commit message as valid, even if it appears in the body (e.g., quoted text) rather than as a trailer/footer. That can lead to false positives and undermines the “trailer” requirement. Consider validating only the trailer block at the end of the commit message (e.g., scan upward from the end after the last blank line, or use a trailer parser strategy) instead of a whole-message regex match.

Suggested change

	const trailerPattern = /^Signed-off-by:\s+.+\s+<[^<>]+>$/im;
	const missing = commits.filter(({ commit }) => !trailerPattern.test(commit.message));
	const hasValidSignedOffTrailer = (message) => {
	if (typeof message !== 'string') {
	return false;
	}
	const lines = message.split('\n');
	// Find the last non-empty line
	let i = lines.length - 1;
	while (i >= 0 && lines[i].trim() === '') {
	i--;
	}
	if (i < 0) {
	return false;
	}
	// Collect the trailer block (continuous non-empty lines at the end)
	const trailerLines = [];
	for (; i >= 0 && lines[i].trim() !== ''; i--) {
	trailerLines.unshift(lines[i]);
	}
	const trailerPattern = /^Signed-off-by:\s+.+\s+<[^<>]+>$/;
	return trailerLines.some((line) => trailerPattern.test(line));
	};
	const missing = commits.filter(({ commit }) => !hasValidSignedOffTrailer(commit.message));

[SToPire]

already a DCO here. close it