Steward
Sign in

Documentation › Contributor guides

Fix a DCO failure

The Steward — DCO check on your PR is red. This guide walks through fixing it. ~5 minutes if you've used git's sign-off flag before, ~10 if it's new.

Background: the Gates concept doc covers what Developer Certificate of Origin (DCO) is + why it's there.

What's wrong

The repo requires every commit to carry a Signed-off-by: trailer in its commit message. Specifically:

Signed-off-by: Your Name <your.email@example.com>

Where your.email@example.com matches the commit's author email. The trailer is the contributor's certification of origin — by adding it, you're attesting that you have the right to contribute the code.

git commit --signoff (or git commit -s) adds the trailer automatically. git commit on its own doesn't.

Click the check-run detail page first

The Steward — DCO check has a Details link that takes you to the failure report. It lists each commit + which identity failed + why. Read it before fixing — sometimes the fix is "your committer email doesn't match your author email" rather than "no Signed-off-by trailer."

Most common failure modes:

Reported issue What to do
No Signed-off-by trailer Use the rebase + force-push remedy below.
Sign-off email doesn't match author email Either fix the sign-off email (rebase with the right one) or fix the commit's author email (git commit --amend --author="Name <correct@email>").
Sign-off says noreply but commit email is real (or vice versa) Pick one and stick to it. Most repos accept either; consistency within a commit is what matters.

Path 1: future commits

For new commits going forward, just use --signoff:

git commit -s -m "fix: handle empty payload edge case"

Or set git to do it automatically:

# For this repo only:
git config format.signoff true

# Or globally for every repo on your machine:
git config --global format.signoff true

With format.signoff true, every git commit adds the trailer for you. There's no downside; many maintainers recommend setting it globally.

Path 2: retro-sign existing commits

You've already pushed N commits without sign-off. To rewrite them with the trailer:

git rebase --signoff HEAD~N

Where N is the number of unsigned commits. If you're not sure how many, check the failure report on the Steward — DCO check run — it lists each one.

Then force-push:

git push --force-with-lease

--force-with-lease is safer than --force — it refuses to overwrite if someone else pushed to your branch since you last pulled. Use it.

Within a few seconds, Steward re-runs the DCO check on the new commits and the Steward — DCO check turns green.

What if a co-author pushed unsigned commits?

If the unsigned commits are by someone else (a co-author, a maintainer who suggested an edit), you can retroactively sign them via the rebase above, but the trailer will name you rather than the original author. Some maintainers care about this; others don't.

If they care, ask the original author to push a sign-off amendment from their fork, then re-pull and force-push from yours. Annoying but accurate.

Path 3: merge commits

If your PR contains merge commits (git merge main brought in during development), Steward exempts them automatically. You don't need to sign them. The check-run failure list will skip merge commits; if you see them flagged anyway, that's a bug worth filing.

Path 4: bot commits

If you're a bot account whose commits should be exempt (Dependabot, Renovate, your org's automation account), the maintainer can add your login to the repo's governance.pxf:

cla: {
  dco_required: true
  exempt_logins: ["dependabot[bot]", "renovate[bot]", "your-bot"]
}

Once that lands on the default branch, your future PRs skip DCO entirely. You can't add yourself — the maintainer controls this list.

Verifying the fix landed

After force-pushing:

  1. Look at the Steward — DCO check on the PR. It should re-run within ~10 seconds and turn green.
  2. If it stays red, click Details. The list will tell you what's still wrong (usually: email mismatch on one of the rewritten commits).
  3. If the check doesn't re-run at all, try /steward evaluate as a PR comment to force a re-check.

Common mistakes

  • git commit --amend without --signoff. Adds nothing. Use git commit --amend --signoff (or just -s) to add the trailer.
  • Editing the commit message manually to add Signed-off-by:. Works mechanically, but if the email is even slightly off (typo, missing brackets), Steward rejects it. Stick to --signoff.
  • Force-pushing without --force-with-lease when someone else has pushed to your branch. You'll silently overwrite their work. Use the safer flag.
  • Rebasing the wrong number of commits. HEAD~N rewrites the last N commits; if you pick N too small, some commits stay unsigned. Pick N too big and you'll rewrite commits on main that you shouldn't touch.

What's next