fix(ci): exempt merge commits from the sign-off requirement

[lockwobr]

Description

Follow-up to #554. The check it added flags every merge commit, so a pull request updated with GitHub's Update branch button fails through no fault of the author.

GitHub authors those merge commits itself with no Signed-off-by trailer, and the person clicking the button has no way to add one. This is not an edge case: 19 of the last 200 commits on main are merge commits and not one carries a sign-off. The sharpest illustration is that the merge commit added to #554 during its own review (1e0cebfd, signoff=NO) would have been flagged by the check #554 introduced.

That is the failure mode #554 was explicitly designed to avoid. A check that flags maintainers on its first day for something they cannot fix is a check everyone learns to ignore, which is the same reasoning used there to drop sign-off/author email matching.

The change

isMerge(c) => (c.parents?.length ?? 0) > 1, and the sign-off requirement is skipped for those commits.

The exemption is sign-off only. A merge introduces no new authorship for the DCO to certify, but it still has to be signed, and GitHub signs the merges its buttons create. parents is already present in the payload the workflow fetches, so nothing new is requested.

CONTRIBUTING.md is updated in the same PR to keep the documented behaviour matching the code, which was a review point on #554.

Testing

Ran the workflow's script against real API payloads:

fixture	before	after
#554's own commits (merge commit, no sign-off)	flagged	passes
merge commit with an unsigned signature	flagged	still flagged (signature)
#537	7 of 7 flagged	3 of 7, the 4 Merge branch 'main' commits exempted
#518, #544, #552, main head with bots	pass	pass
spoofed [bot] git identity, sign-off quoted in prose	flagged	flagged

The #537 line is the point: the three genuinely unsigned-off commits are still reported, and the four merge commits that were drowning them out are not.

actionlint and make license-header-check are clean.

Checklist

• I am familiar with the Contributing Guidelines.
• My commits are signed off per the DCO and cryptographically signed: git commit -s -S.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[github-actions]

❌ Some commits are missing a sign-off or a signature

Every commit in this repository must be signed off (-s, the DCO certification that you wrote the patch) and cryptographically signed (-S, proving the commit came from you). They are independent; you need both, on every commit.

Commit	Subject	Problem
c11d125f	Merge branch 'main' into fix/commit-requirements-merge-commits	no Signed-off-by trailer (git commit -s)

How to fix

One-time setup, so you only ever need -s from here on:

# Commit identity, used in the Signed-off-by trailer.
# Use an address GitHub has verified on your account.
git config user.name "Your Name"
git config user.email "your.email@example.com"

# Signing key, separate from the identity above. For SSH:
git config gpg.format ssh
git config user.signingkey ~/.ssh/id_ed25519.pub

# Sign every commit from now on
git config commit.gpgsign true

The key must also be registered with GitHub: see generating a GPG or SSH signing key.

To fix the most recent commit:

git commit --amend -s -S --no-edit
git push --force-with-lease origin 'fix/commit-requirements-merge-commits'

To fix every commit on the branch at once. Check for merge commits first, because a plain rebase drops them:

git log --oneline --merges origin/main..HEAD   # empty output means linear

# Linear branch:
git rebase --exec 'git commit --amend -s -S --no-edit' origin/main

# Branch with merge commits, preserving them:
git rebase --rebase-merges --exec 'git commit --amend -s -S --no-edit' origin/main

Confirm the rewrite changed nothing but the signatures before pushing:

git range-diff @{u}...HEAD
git push --force-with-lease origin 'fix/commit-requirements-merge-commits'

Re-signing rewrites every commit, which outdates inline review comments. If the PR is already under review, leave a note saying you force-pushed.

Full details are in CONTRIBUTING.md. This check reports but does not block your merge; a maintainer will still ask you to fix it.

[lockwobr]

Note for reviewers: the failing Sign-off and signature check on this PR is the bug this PR fixes, not a problem with the fix.

c11d125f is the merge commit the Update branch button just created. It is verified=true but carries no Signed-off-by, because GitHub authors it and offers no way to add one. That is precisely the case this change exempts.

The check cannot exercise the fix here: pull_request_target workflows run from the base branch, so this PR is being evaluated by the pre-fix version still on main. It will keep reporting red until this merges, and merging is what stops it.

Running this branch's version of the script against this PR's own two commits:

5b31421f parents=1 verified=true signoff=yes
c11d125f parents=2 verified=true signoff=NO
All 2 non-bot commit(s) are signed off and signed.
RESULT: PASSES

The check is otherwise behaving correctly: it identified the right commit, gave an accurate reason, and did not block the merge, since it deliberately publishes no ci-gate status.

[coderabbitai]

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/commit-requirements-merge-commits

---

_{Comment @coderabbitai help to get the list of available commands.}