ci: enforce action contribution gates

.github/workflows/test.yml

@@ -10,6 +10,54 @@ permissions:
   contents: read
 
 jobs:
+  commitlint:
+    name: Commit messages follow Conventional Commits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '20'
+      - run: npm install --no-save @commitlint/cli@19 @commitlint/config-conventional@19
+      - name: Validate PR title
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: printf '%s\n' "$PR_TITLE" | npx commitlint --extends '@commitlint/config-conventional'
+      - name: Validate commits in PR
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: npx commitlint --extends '@commitlint/config-conventional' --from "$BASE_SHA" --to "$HEAD_SHA" --verbose
+
+  dco-check:
+    name: All commits signed off (DCO)
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Verify Signed-off-by on each commit
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -e
+          missing=$(git log --format='%H %s' "${BASE_SHA}..${HEAD_SHA}" | while read -r sha rest; do
+            if ! git log -1 --format=%B "$sha" | grep -q '^Signed-off-by: '; then
+              echo "$sha"
+            fi
+          done)
+          if [ -n "$missing" ]; then
+            echo "::error::The following commits are missing a Signed-off-by line:"
+            echo "$missing"
+            exit 1
+          fi
+
   lint:
     name: Lint action.yml, scripts, and example workflows
     runs-on: ubuntu-latest
@@ -80,7 +128,7 @@ jobs:
           # Pin the real published asset exercised by this regression
           # test. The moving "latest" release must not change the
           # behaviour under test between otherwise identical runs.
-          version: v1.5.0
+          version: v1.5.1
           scope: namespace:demo
           output: artifacts/demo.svg
           policy-report: 'true'