The gap
ADR-0006 action item 2 is "DCO bot enabled on the repository." Sign-off is practiced and documented, but not enforced — so the control is honor-system.
Practiced. Every recent commit carries a Signed-off-by trailer, including external contributions (261e38b, from davids).
Documented.
CONTRIBUTING.md § "Sign-off is required" — "All commits require a DCO sign-off. There is no CLA.".github/PULL_REQUEST_TEMPLATE.md, checklist item 1.
Not enforced. The active main ruleset (19149458) requires exactly seven status checks:
clean-clone-builds
node-smoke-built-artifacts (22.x)
node-smoke-built-artifacts (24.x)
audit
self-dogfood
Analyze (actions)
Analyze (javascript-typescript)
No DCO check among them, and no DCO GitHub App installed. An unsigned commit would merge today.
Why it matters
ADR-0006 chose DCO over a CLA deliberately — it "forecloses a rug-pull" while keeping contribution friction low. That reasoning only holds if sign-off is actually present on every commit in the history. A documented-but-unenforced DCO gives the paperwork of provenance without the guarantee, which is the weaker half of the trade the ADR made.
This is also the one ADR-0006 action item that could not be ticked during ratification (#129) — the others are either done or unverifiable from the tree.
Options
- DCO GitHub App (probot/dco) — the conventional choice; zero maintenance, adds a
DCO check.
- A small workflow — verify every commit in the PR range carries a
Signed-off-by trailer matching the author. No third-party app install, and it stays inside the repo's own CI surface.
Either way the check must be added to the main ruleset's required checks, or it is advisory only and the gap stays open.
Option 2 is probably the better fit — it avoids a third-party app on a repository whose IP boundary ADR-0007 deliberately keeps mechanical and self-contained.
Done when
Found while ratifying the pending ADR queue in #129.
The gap
ADR-0006 action item 2 is "DCO bot enabled on the repository." Sign-off is practiced and documented, but not enforced — so the control is honor-system.
Practiced. Every recent commit carries a
Signed-off-bytrailer, including external contributions (261e38b, fromdavids).Documented.
CONTRIBUTING.md§ "Sign-off is required" — "All commits require a DCO sign-off. There is no CLA.".github/PULL_REQUEST_TEMPLATE.md, checklist item 1.Not enforced. The active
mainruleset (19149458) requires exactly seven status checks:No DCO check among them, and no DCO GitHub App installed. An unsigned commit would merge today.
Why it matters
ADR-0006 chose DCO over a CLA deliberately — it "forecloses a rug-pull" while keeping contribution friction low. That reasoning only holds if sign-off is actually present on every commit in the history. A documented-but-unenforced DCO gives the paperwork of provenance without the guarantee, which is the weaker half of the trade the ADR made.
This is also the one ADR-0006 action item that could not be ticked during ratification (#129) — the others are either done or unverifiable from the tree.
Options
DCOcheck.Signed-off-bytrailer matching the author. No third-party app install, and it stays inside the repo's own CI surface.Either way the check must be added to the
mainruleset's required checks, or it is advisory only and the gap stays open.Option 2 is probably the better fit — it avoids a third-party app on a repository whose IP boundary ADR-0007 deliberately keeps mechanical and self-contained.
Done when
mainruleset's required status checksFound while ratifying the pending ADR queue in #129.