Add check-dco hook: verify commit message Signed-off-by

[Ikalus1988]

Summary

Add check-dco hook: validates commit messages contain a valid Signed-off-by: Name <email> line per the Developer Certificate of Origin.

Motivation

Projects under CNCF, Linux Foundation, and many other organizations require DCO sign-off on every commit. Without local validation, a missing sign-off is only caught in CI after push, wasting runner time and disrupting contribution flow.

This hook shifts the check left to the commit-msg stage — purely local, zero network access, zero external dependencies.

Implementation

• Pure Python, stdlib only (re, argparse, sys)
• stages: [commit-msg] — reads the temporary commit message file from argv[1]
• Returns non-zero on missing or malformed Signed-off-by line
• No git log calls (behavior is deterministic from the commit message file alone)

Tests

Standard sign-off, multiple sign-offs, sign-off in body, full name with dots, email with + addressing, multiline commit message, missing sign-off, empty message, malformed (no email, no name, lowercase, missing colon), and main() CLI integration. All pass.

[Ikalus1988]

Hi @asottile,

All CI checks are now fully green, including the metadata collector and the Python test matrix. ✅

This PR introduces the check-dco hook to validate the Signed-off-by line at the local commit-msg stage. Given that major open-source foundations (such as CNCF and the Linux Foundation) strictly enforce DCO compliance, missing a signature is one of the most frequent reasons contributor PRs fail remotely.

To keep this alignment with the core project's philosophy, the implementation is:

• Zero-dependency: Built entirely on the Python standard library (re, sys, argparse).
• Lightweight: Processes the raw commit message file directly in milliseconds without calling heavy git subprocesses.

I believe this will be a highly practical addition for Python-centric repositories looking to catch DCO omissions before they hit CI.

Whenever you have a moment, I would welcome your review and feedback on this implementation. Thanks~~

[asottile]

• wasn't discussed in an issue first (well actually it was and already declined)
• we don't accept slop prs
• you can do this with no code via pygrep