From 77ca5860a49999a7cf0276e586e59101585491a7 Mon Sep 17 00:00:00 2001
From: Jakub Zelenka <bukka@php.net>
Date: Fri, 18 Apr 2025 17:27:39 +0200
Subject: [PATCH] Require Developer Certificate of Origin (DCO)

Signed-off-by: Jakub Zelenka <bukka@php.net>
---
 .github/workflows/dco.yml | 43 +++++++++++++++++++++++++++++++++++++++
 CONTRIBUTING.md           | 21 +++++++++++++++++++
 DCO.txt                   | 34 +++++++++++++++++++++++++++++++
 3 files changed, 98 insertions(+)
 create mode 100644 .github/workflows/dco.yml
 create mode 100644 DCO.txt

diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
new file mode 100644
index 0000000000000..2c37a150f87ee
--- /dev/null
+++ b/.github/workflows/dco.yml
@@ -0,0 +1,43 @@
+name: DCO Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  dco:
+    name: Check Signed-off-by in commits
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fetch base branch
+        run: git fetch origin ${{ github.base_ref }}
+
+      - name: Check commits for Signed-off-by
+        run: |
+          git log --pretty=format:"%H %P %s%n%b%n==END==" origin/${{ github.base_ref }}...HEAD |
+          awk '
+            BEGIN { commit = ""; parent_count = 0; has_signed_off = 0; }
+            /^[0-9a-f]{40} / {
+              commit = $1;
+              n = split($0, parts, " ");
+              parent_count = n - 2;
+              next;
+            }
+            /==END==/ {
+              if (parent_count < 2 && !has_signed_off) {
+                print "Commit " commit " is missing Signed-off-by";
+                exit 1;
+              }
+              commit = "";
+              parent_count = 0;
+              has_signed_off = 0;
+              next;
+            }
+            /Signed-off-by:/ { has_signed_off = 1; }
+          '
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e5b2e91d63d1b..7664c56aab967 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -59,6 +59,27 @@ and build PHP source code. We recommend to look at our
 [workflow](https://wiki.php.net/vcs/gitworkflow) and our
 [FAQ](https://wiki.php.net/vcs/gitfaq).
 
+All contributions must comply with the Developer Certificate of Origin.
+
+Each commit must include a Signed-off-by line with your name and email address.
+
+You can add it automatically by using:
+
+```bash
+git commit -s
+```
+
+Example commit message:
+
+```
+Fix bug in X
+
+Signed-off-by: Jane Developer <jane@example.com>
+```
+
+By signing off, you confirm that you have the right to submit your code under the
+PHP License.
+
 ## Filing bugs
 
 Bugs can be filed on [GitHub Issues](https://github.com/php/php-src/issues/new/choose).
diff --git a/DCO.txt b/DCO.txt
new file mode 100644
index 0000000000000..c9bb9efa798be
--- /dev/null
+++ b/DCO.txt
@@ -0,0 +1,34 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2025-present PHP Group and its contributors.
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.