[vladimirrott]

Summary

Three CI changes from the OpenSSF review, in two commits.

A required DCO sign-off (#713). scripts/check_dco.sh BASE HEAD reads the non-merge commits in the range and fails any without a Signed-off-by trailer, as git parses trailers, whose address matches the commit author's. It accepts Dependabot's one pairing (it authors as its noreply address and signs off as support@github.com) and no other. An empty, unresolvable or merge-only range gets refused with "nothing was checked". On failure it prints the commands that sign off pushed commits; they fetch main by URL, so they work from a fork whatever its remotes are called. A new dco job runs it on every pull request with full history. CONTRIBUTING.md, docs/contributing/CONTRIBUTING.md, the developer guide and the PR template now say a sign-off is required. The developer guide also names the seven required checks in place of a stale "five".

Pages and OIDC grants scoped to the deploy job (#714). docs.yml granted pages: write and id-token: write to the whole workflow. The build job now holds contents: read; deploy gets the two grants the actions/deploy-pages README lists as its minimum.

The crates.io token off the command line (#715). release.yml ran cargo publish --token "$CARGO_REGISTRY_TOKEN". cargo reads that variable from the environment, so the flag only put the token in argv. tests/release/secret-argv.test.sh now fails any workflow that expands a secret-fed variable outside a test -n "${NAME:-}" check, or pastes ${{ secrets.* }} into a script.

Related Issue

Closes #713, closes #714, closes #715. Part of #731.

Validation

• Tests added or updated

• Documentation updated if behavior changed

• Security impact considered

• Trust boundary preserved (daemon remains the only privileged executor)

• CI passes

• Every commit is signed off (git commit -s, see CONTRIBUTING.md)

• tests/release/dco.test.sh builds throwaway repositories for each case. I ran it against a stub that passes everything first (11 cases failed), then against eight mutants of the script, and each one failed it: tip-only, a regex in place of git's trailer parser, case-sensitive matching, no empty-range guard, the bot address accepted for anyone, merges counted, unsigned exiting 0, no ref guard.

• tests/release/secret-argv.test.sh failed on the old release.yml. Five mutants of its scanner each fail the fixtures. A sixth showed the empty-directory branch could not be reached, so I removed it.

• scripts/check_dco.sh against real ranges: this branch passes (2 commits), build: honour DESTDIR in make install and ship LICENSE in every package #710 passes, and five of the six open contributor pull requests (test(e2e): smoke-test multiple VM daemons over SSH tunnels #709, fix: reject wrong-typed optional action params #701, fix(release): gate tags on main CI #700, fix: preserve active swap files when swapoff fails #698, fix(brain): align AptAutoremove prose with daemon risk #695) fail on unsigned commits.

• check_test_reachability.sh fails when the new dco.test.sh step is removed from ci.yml, so the gate sees it.

• Pre-commit gate (fmt, clippy --all-targets, doc, nextest against the baseline) and scripts/ci-local.sh --fast pass.

Notes for Reviewers

Once this merges I add dco to the main ruleset's required checks and tell the five authors above how to sign off their commits. The docs.yml change gets its real test on the first docs deploy from main, which this merge triggers because the workflow file is in its own paths filter.

🤖 Generated with Claude Code