Skip the DCO check on release PRs into main

.github/workflows/ci.yml

@@ -197,7 +197,9 @@ jobs:
 
   dco:
     name: DCO sign-off
-    if: ${{ github.event_name == 'pull_request' }}
+    # Release PRs (development into main) carry the whole history, including commits from before
+    # sign-off was required. Their commits were already checked on their way into development.
+    if: ${{ github.event_name == 'pull_request' && github.base_ref != 'main' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:

CHANGELOG.md

@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - The metrics API builds with Go 1.27 (`go.mod` and the Docker builder image `golang:1.27-alpine`). Replaces Dependabot PR #5, which bumped only the Dockerfile.
+- The DCO sign-off CI job skips release pull requests into `main`. Their commits were already checked on their way into `development`, and the history includes commits from before sign-off was required.
 
 ## [1.0.0] - 2026-11-01
 

CONTRIBUTING.md

@@ -111,7 +111,7 @@ git rebase --signoff development
 git push --force-with-lease
 ```
 
-The **DCO sign-off** CI job checks every commit in a pull request (merge commits aside) for a `Signed-off-by` line with the commit author's email. Dependabot's commits and commits written by the maintainers' AI coding assistant are exempt; a maintainer reviews and merges those.
+The **DCO sign-off** CI job checks every commit in a pull request (merge commits aside) for a `Signed-off-by` line with the commit author's email. Dependabot's commits and commits written by the maintainers' AI coding assistant are exempt; a maintainer reviews and merges those. The job does not run on release pull requests into `main`, because their commits were already checked on their way into `development`.
 
 If your employer has rights to code you write, make sure you are allowed to contribute before you sign off.