chore: add local DCO sign-off check

.gitattributes

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 
+.githooks/* text eol=lf
 *.pdf filter=lfs diff=lfs merge=lfs -text
 *.png filter=lfs diff=lfs merge=lfs -text
 *.jpg filter=lfs diff=lfs merge=lfs -text

.githooks/commit-msg

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# SPDX-License-Identifier: Apache-2.0
+
+set -eu
+
+git rev-parse -q --verify MERGE_HEAD >/dev/null 2>&1 && exit 0
+
+author=$(git var GIT_AUTHOR_IDENT)
+author=${author% *}
+author=${author% *}
+
+committer=$(git var GIT_COMMITTER_IDENT)
+committer=${committer% *}
+committer=${committer% *}
+
+git -c trailer.separators=: interpret-trailers --parse --no-divider "$1" |
+	grep -iFqx -e "Signed-off-by: $author" -e "Signed-off-by: $committer" && exit 0
+
+printf >&2 'Missing DCO sign-off. Re-run your commit command with --signoff.\n'
+exit 1

.githooks/test-commit-msg

@@ -0,0 +1,49 @@
+#!/bin/sh
+
+# SPDX-License-Identifier: Apache-2.0
+
+set -eu
+
+hook=$(dirname "$0")/commit-msg
+message=$(mktemp)
+repository=$(mktemp -d)
+trap 'rm -f "$message"; rm -rf "$repository"' EXIT
+
+export GIT_COMMITTER_NAME='DCO Test'
+export GIT_COMMITTER_EMAIL='dco@example.com'
+export GIT_AUTHOR_NAME='DCO Author'
+export GIT_AUTHOR_EMAIL='author@example.com'
+
+printf 'Test\n\nSigned-off-by: DCO Test <dco@example.com>\n' >"$message"
+"$hook" "$message"
+
+printf 'Test\n\n---\n\nSigned-off-by: DCO Test <dco@example.com>\n' >"$message"
+"$hook" "$message"
+
+GIT_CONFIG_COUNT=1 \
+	GIT_CONFIG_KEY_0=trailer.separators \
+	GIT_CONFIG_VALUE_0='=' \
+	"$hook" "$message"
+
+printf 'Test\n\nSigned-off-by: DCO Author <author@example.com>\n' >"$message"
+"$hook" "$message"
+
+printf 'Test\n\nSigned-off-by: Someone Else <else@example.com>\n' >"$message"
+if "$hook" "$message" 2>/dev/null; then
+	printf >&2 'Unrelated sign-off was accepted\n'
+	exit 1
+fi
+
+printf 'Test\n' >"$message"
+
+git init --quiet "$repository"
+git -C "$repository" config user.name 'DCO Test'
+git -C "$repository" config user.email 'dco@example.com'
+git -C "$repository" -c commit.gpgsign=false -c core.hooksPath=/dev/null commit --allow-empty --quiet -m 'Test'
+git -C "$repository" rev-parse HEAD >"$repository/.git/MERGE_HEAD"
+GIT_DIR="$repository/.git" "$hook" "$message"
+
+if "$hook" "$message" 2>/dev/null; then
+	printf >&2 'Unsigned commit message was accepted\n'
+	exit 1
+fi

.github/workflows/license-headers.yml

@@ -18,6 +18,8 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Check DCO commit hook
+        run: .githooks/test-commit-msg
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: link/go.mod

spec/CONTRIBUTING.md

@@ -49,6 +49,17 @@ Ensure that you base and target your PR on the `master` branch.
 
 ### Development Procedure
 
+Install the repository's DCO check once after cloning:
+
+```sh
+cp -i .githooks/commit-msg "$(git rev-parse --git-common-dir)/hooks/commit-msg"
+```
+
+The hook rejects non-merge commits without your `Signed-off-by` trailer. Read
+the [Developer Certificate of Origin](https://developercertificate.org/), then
+re-run your commit command with `--signoff`. To repair the latest commit, use
+`git commit --amend --signoff`. Git explains [why sign-off must be intentional](https://git-scm.com/docs/gitfaq#Documentation/gitfaq.txt-Whynotcodecommitsignoffcodeandotherconfigurationvariables).
+
 - The latest state of development is on `master`.
 - Create a development branch either on `github.com/cosmos/ibc` or your fork (using `git remote add fork`).
   - To ensure a clear ownership of branches on the ibc repo, branches must be named with the convention `{moniker}/{issue#}-branch-name`