[cgwalters-bot]

Adds the /signoff PR command to every repository. A maintainer comments /signoff, and their Signed-off-by is added to all of the PR's commits, which otherwise stay byte for byte the same. /rebase-signoff also moves the commits onto the target branch. DCO is required by the org's default ruleset.

This is plain Actions with no LLM, following the review of bootc-dev#261. The logic is the pr-signoff reusable workflow in bootc-dev/actions (cgwalters-forge/actions#2 has the design, the security notes and the search for existing tools that bootc-dev#260 asked for). This PR adds:

• common/.github/workflows/signoff.yml, the stub, which sync-common installs in every bootc-dev and composefs repository;
• .github/workflows/signoff.yml, a copy for this repository, since the sync skips it;
• a DCO section in docs/repository-structure.md.

bootc gets the same file ahead of the sync in cgwalters-forge/bootc#16.

About the stub:

• It uses the bootc-bot App (vars.GH_AW_APP_CLIENT_ID/secrets.GH_AW_APP_PRIVATE_KEY, as merge.yml does) with its workflows permission. Those credentials are installed org-wide on bootc-dev. For composefs, where sync-common also installs the stub, it is unconfirmed: the org variable and secret still need setting there, or the stub falls back to GITHUB_TOKEN (same-repository PRs only, and no CI on the new head).
• It pins the actions workflow by commit (@<sha> # main), because it hands the App key to it. The pin is currently the actions PR's head, and must be bumped to the commit that lands in bootc-dev/actions before merging. Future bumps go in common/, and sync-common carries them.
• Its if: only lets through human (User) comments on PRs that start with a command. Anything else is a skipped run with no runner, e.g. this run.

Testing

actionlint is clean on both stubs. The runs below are real, on cgwalters-forge/infra, with the stub pinned to the actions PR head. The forge has no App, so they used the GITHUB_TOKEN fallback:

• A plain comment produced a skipped run, with no runner.
• /signoff without a SHA on 2 unsigned commits worked (run). One commit's message has trailing whitespace and the other is Latin-1 with an encoding header. Afterwards the trees and author lines were identical, each message began with the original bytes followed by the trailer, the encoding header was kept, and the commenter was the committer.
• /signoff <12-hex head> on the result replied "nothing to do" (run).
• /rebase-signoff <12-hex head> after the base moved put both commits on the new tip, each with one trailer (run).
• These were refused:
  • a 7-hex SHA, with the usage message (run);
  • a stale SHA (run);
  • a head branch with a non_fast_forward ruleset (run);
  • a head that is the default branch (run);
  • a fork PR without maintainer edits (run);
  • a fork PR with maintainer edits, which got as far as needing an App token (run).
• Reactions were 👀 then 🚀 or 😕 on every command.

The App-token path is untested: minting the token, the workflows permission, and pushing to fork PRs. It must get one real run here, with the bootc-bot App, before anyone relies on it.

Supersedes bootc-dev#261
Closes bootc-dev#260

Generated-by: https://github.com/cgwalters/#llms

---

Review draft in cgwalters-forge, not upstream yet. This section is removed when the PR is opened upstream.

• Upstream: bootc-dev/infra, base main
• Board item: PVTI_lADOE9oHIs4BlJLczg9kERg
• Fork CI: off; the devspace testing described above is this PR's CI, and upstream CI runs once it is opened there

To review:

• Approve, or comment /promote on a line of its own, to open it upstream, ready for review. Either covers only the commits pushed so far.
• If upstream requires DCO, approving also signs off: promote adds Signed-off-by: Colin Walters <walters@verbum.org> to the commits lacking it (the bot's and yours; anyone else's only if you ask), with you as committer.
• Add a /draft line (in the same comment or before) to open it upstream as a draft (/ready undoes that).
• Close to drop it.
• Edit the title and description freely: they become the upstream PR's. Review comments are squashed into the commits they concern, with a reply here.