diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 00000000..1ebb13b7 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,33 @@ +## Scope + +Describe the focused change and why it is needed. + +## Provenance and licensing + +- [ ] Every human-authored commit has a valid `Signed-off-by` trailer under [DCO.md](../DCO.md). +- [ ] I created this contribution or am authorized to submit it for distribution under the repository's MIT License. +- [ ] I disclosed copied/adapted code, snippets, templates, media, data and generated assets below. +- [ ] I identified the source and license of every third-party element. +- [ ] I am authorized to contribute work created for an employer, client or other rights holder, where applicable. +- [ ] I disclosed material AI assistance and performed human review/provenance verification below. +- [ ] This contribution does not include material with unknown, incompatible or non-redistributable terms. + +### Third-party material + +State `None`, or list each source, license, modification and permission basis. + +### Employer/client authorization + +State `Not applicable`, or identify the organization and non-confidential authorization basis. + +### AI assistance + +State `None`, or identify the tool/use and describe the human review and provenance checks performed. + +### Exceptions or private permissions + +State `None`, or link the decision record in `docs/legal/CONTRIBUTION-EXCEPTIONS.md`. Do not publish confidential permission documents. + +## Validation + +List the checks or document review performed. For documentation/governance-only changes, state that no application behavior changed. diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml new file mode 100644 index 00000000..0d8ebc82 --- /dev/null +++ b/.github/workflows/dco.yml @@ -0,0 +1,61 @@ +name: DCO sign-off + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + +jobs: + dco: + name: Verify commit sign-offs + runs-on: ubuntu-latest + timeout-minutes: 5 + + steps: + - name: Check out pull-request head + uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 0 + + - name: Verify DCO trailers + shell: bash + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + set -euo pipefail + + missing=0 + checked=0 + + while IFS= read -r commit; do + author_name="$(git show -s --format='%an' "$commit")" + author_email="$(git show -s --format='%ae' "$commit")" + + if [[ "$author_name" == *"[bot]"* ]] || + [[ "$author_email" == *"[bot]@users.noreply.github.com" ]]; then + echo "Bot exception: $commit $author_name <$author_email>" + continue + fi + + checked=$((checked + 1)) + if ! git show -s --format='%B' "$commit" | + grep -Eq '^Signed-off-by: .+ <[^<>[:space:]]+@[^<>[:space:]]+>$'; then + echo "::error::Commit $commit by $author_name <$author_email> lacks a valid Signed-off-by trailer." + missing=1 + fi + done < <(git rev-list "${BASE_SHA}..${HEAD_SHA}") + + if [[ "$checked" -eq 0 ]]; then + echo "No human-authored commits require DCO verification." + fi + + if [[ "$missing" -ne 0 ]]; then + echo "Add a DCO trailer with: git commit --amend --signoff" + exit 1 + fi + + echo "DCO verified for $checked human-authored commit(s)." diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0053ad99..84a9eed5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -2,6 +2,22 @@ SightAdapt is in an alpha stage. Contributions should prioritize user safety, predictable behavior, and Windows 10/11 compatibility. +## Developer Certificate of Origin + +SightAdapt uses the [Developer Certificate of Origin 1.1 workflow](DCO.md). Every human-authored commit in a pull request must contain a valid sign-off: + +```text +Signed-off-by: Full Name +``` + +Create signed-off commits with: + +```bash +git commit --signoff +``` + +The sign-off certifies that the contributor created the work or is authorized to submit it, and that it may be distributed under the repository's MIT License subject to clearly identified compatible third-party terms. The DCO workflow must pass before merge. + ## Product identity Public naming and attribution must follow [the SightAdapt product identity standard](docs/BRAND.md). @@ -28,10 +44,26 @@ dotnet build src/SightAdapt/SightAdapt.csproj -c Release Create a self-contained executable with the steps in [docs/BUILD.md](docs/BUILD.md). +## Contribution provenance + +The pull request template requires disclosure of: + +- copied or adapted code, snippets, documentation, templates, media, data or generated assets; +- the source, license and modifications for third-party material; +- employer, client or organization authorization where applicable; +- material AI assistance and the human provenance review performed; +- any requested exception or private permission record. + +Do not add code, tests, documentation, icons, screenshots, data or other creative material whose origin or license is unknown, incompatible or not redistributable. AI-assisted output must be reviewed by the human contributor, checked for restricted/confidential material and covered by the contributor's DCO certification. + +The complete policy, employer process, historical review and exception handling are documented in [Contribution provenance](docs/legal/CONTRIBUTION-PROVENANCE.md) and [Contribution exceptions](docs/legal/CONTRIBUTION-EXCEPTIONS.md). + ## Pull requests - keep changes focused; -- describe Windows versions and DPI configurations tested; +- complete the provenance and licensing checklist in the pull request template; +- sign off every human-authored commit; +- describe Windows versions and DPI configurations tested when application behavior changes; - do not add DLL injection or kernel drivers; - do not add telemetry, analytics, remote crash reporting, automatic diagnostic upload, update checks, cloud synchronization or another network/data-collection feature without completing the privacy review defined in [PRIVACY.md](PRIVACY.md); - update `PRIVACY.md` in the same pull request when local processing, network behavior, support-data handling or retention changes; diff --git a/DCO.md b/DCO.md new file mode 100644 index 00000000..6bcdfe17 --- /dev/null +++ b/DCO.md @@ -0,0 +1,68 @@ +# Developer Certificate of Origin policy + +SightAdapt uses the **Developer Certificate of Origin, Version 1.1 (DCO 1.1)** rather than a contributor license agreement. + +The authoritative DCO text is published at: + +https://developercertificate.org/ + +By adding a `Signed-off-by` trailer to a commit, a contributor certifies that at least one of the DCO provenance paths applies: the contributor created the work and may submit it, the work is based on appropriately licensed material that may be submitted, or the contribution was passed through by another person who made the same certification. The contributor also acknowledges that the contribution and sign-off form part of the public project history. + +For SightAdapt, the sign-off additionally confirms that the contributor has the right to submit the complete contribution for distribution under the repository's MIT License and any clearly identified separate license that already governs included third-party material. + +## Required commit trailer + +Every human-authored commit in a pull request must contain: + +```text +Signed-off-by: Full Name +``` + +The name and email must identify the person making the certification. A GitHub no-reply address may be used. Add the trailer automatically with: + +```bash +git commit --signoff +``` + +To sign an existing commit: + +```bash +git commit --amend --signoff +``` + +A contributor who rewrites several commits must add a valid trailer to each commit, not only the final commit. + +## Covered contributions + +The policy applies to: + +- application code and build scripts; +- tests and test data; +- documentation and translations; +- icons, screenshots, diagrams, audio, video and other creative assets; +- configuration, templates, generated files and datasets; +- AI-assisted material retained in the contribution. + +## Employer or client work + +A person contributing work created within employment, a contract or another organization must confirm that they are authorized to submit it. Where an employer or client owns the relevant rights, the contributor must obtain the necessary permission before signing off. A maintainer may request a non-confidential confirmation of authority and may record the existence of supporting permission in the exceptions register. + +## Third-party and generated material + +Pull requests must disclose copied code, adapted snippets, external templates, generated assets, datasets and other third-party material. The disclosure must identify the source, applicable license and modifications. Do not submit material with unknown, incompatible, non-redistributable or unverifiable terms. + +AI tools do not provide provenance or permission. A contributor using AI assistance remains responsible for: + +- reviewing every retained output; +- verifying that it is correct and appropriate for the project; +- checking for copied, restricted or confidential material; +- documenting material AI assistance in the pull request; +- ensuring that the contributor can make the DCO certification for the final contribution. + +## Exceptions + +A DCO exception is not granted merely because adding a sign-off is inconvenient. Bot-generated dependency or maintenance commits may use the documented bot exception when the bot identity and generated source are clear. Any other exception requires a maintainer decision recorded in `docs/legal/CONTRIBUTION-EXCEPTIONS.md`. Supporting permissions that contain confidential information are retained outside the public repository; the public record identifies the scope, reviewer, date and decision without publishing privileged or personal material. + +## Enforcement + +`.github/workflows/dco.yml` checks every non-bot commit in a pull request for a valid `Signed-off-by` trailer. The DCO status should be configured as a required branch-protection check for protected branches. A pull request must not be merged while the DCO check is failing or a required provenance disclosure is unresolved. diff --git a/docs/README.md b/docs/README.md index a6f49ee7..032d154e 100644 --- a/docs/README.md +++ b/docs/README.md @@ -8,10 +8,13 @@ The documentation describes the current SightAdapt implementation and the canoni - [Microsoft .NET redistribution analysis](legal/DOTNET-REDISTRIBUTION.md) — Microsoft-origin component inventory, applicable terms, package implementation, review triggers and professional-review gate. - [Exact-version .NET notice generation](legal/DOTNET-NOTICE-GENERATION.md) — pinned SDK/runtime inputs, official package verification, notice import, checksums and update triggers. - [SBOM and dependency-license review](legal/SBOM-AND-LICENSE-REVIEW.md) — SPDX inventory, license policy, generated reports and release failure rules. +- [Contribution provenance and historical review](legal/CONTRIBUTION-PROVENANCE.md) — DCO adoption, employer/AI/third-party rules, history review and maintainer process. +- [Contribution exceptions](legal/CONTRIBUTION-EXCEPTIONS.md) — public records for exceptional permission and bot decisions. - [Complete functionality](FEATURES.md) — user-visible behavior, profiles, application assignments, overlay scopes, switching, settings, safety, and limitations. - [Current architecture](ARCHITECTURE.md) — authorities, sources of truth, settings transaction, foreground switching, overlay lifecycle, geometry, UI boundaries, and failure behavior. - [Build and package a standalone EXE](BUILD.md) — step-by-step local self-contained Windows x64 publication and archive verification. - [Privacy notice](../PRIVACY.md) +- [Developer Certificate of Origin policy](../DCO.md) - [Dependency inventory](../DEPENDENCIES.md) - [Microsoft .NET redistribution notice](../MICROSOFT-DOTNET-REDISTRIBUTION.txt) - [Third-party notices](../THIRD-PARTY-NOTICES.txt) diff --git a/docs/legal/CONTRIBUTION-EXCEPTIONS.md b/docs/legal/CONTRIBUTION-EXCEPTIONS.md new file mode 100644 index 00000000..648caee5 --- /dev/null +++ b/docs/legal/CONTRIBUTION-EXCEPTIONS.md @@ -0,0 +1,32 @@ +# Contribution provenance exceptions + +This register records non-confidential decisions for contributions that cannot follow the ordinary DCO path or require additional permission evidence. + +Confidential employer permissions, contracts, legal advice and personal information must not be committed to this repository. Store them privately and record only the minimum public decision metadata below. + +## Required record fields + +- date; +- pull request or commit; +- contribution scope; +- contributor or bot identity; +- reason the ordinary DCO path was unavailable; +- license and provenance reviewed; +- supporting evidence location or custodian, without publishing confidential contents; +- maintainer reviewer; +- decision and conditions. + +## Standing bot exception + +Automated commits from clearly identified maintenance bots may omit a personal DCO trailer when: + +- the bot identity ends with `[bot]`; +- the generated source and changed dependency or file are clear from the pull request; +- a human maintainer reviews the resulting diff, license and provenance before merge; +- the contribution does not introduce unknown or incompatible material. + +The DCO workflow exempts bot-authored commits on this basis. A bot exception does not exempt the pull request from dependency, license or maintainer review. + +## Recorded exceptions + +None as of 2026-07-29. diff --git a/docs/legal/CONTRIBUTION-PROVENANCE.md b/docs/legal/CONTRIBUTION-PROVENANCE.md new file mode 100644 index 00000000..c6d2d0ac --- /dev/null +++ b/docs/legal/CONTRIBUTION-PROVENANCE.md @@ -0,0 +1,49 @@ +# Contribution provenance and historical review + +## Policy decision + +SightAdapt adopts the Developer Certificate of Origin 1.1 workflow documented in [`DCO.md`](../../DCO.md). The project does not require a separate contributor license agreement at this stage. + +A valid sign-off confirms that the contributor has the right to submit the contribution and permits its distribution under the repository's MIT License, subject to any clearly identified compatible third-party terms. + +## Provenance requirements + +Every pull request must identify: + +- whether the work is entirely original to the contributor; +- copied or adapted code, snippets, documentation, templates or assets; +- source URLs and licenses for third-party material; +- employer, client or organization ownership where relevant; +- material AI assistance used to create retained content; +- permissions or exceptions required for anything not covered by the normal DCO path. + +Maintainers must reject material whose origin, ownership or license cannot be established. This applies equally to code, tests, documentation, translations, icons, screenshots, diagrams, datasets and generated assets. + +## Employer and organizational contributions + +A contributor acting for an employer, client or other rights holder must have authority to submit the work. The pull request should state the organization and authorization basis without exposing confidential terms. When additional evidence is required, it is reviewed privately and only a non-confidential decision record is added to the exceptions register. + +## AI-assisted contributions + +AI assistance does not transfer responsibility to the tool provider. The human contributor must review the complete output, verify provenance, remove confidential or restricted material and make the DCO certification personally. A pull request must disclose material AI assistance and describe the human review performed. + +## Historical review — 2026-07-29 + +The repository pull-request history available through PR #130 was reviewed for independently attributed contributions. The reviewed PR records identify `KeyffMS` as the author. No merged pull request authored by an independent non-owner contributor was identified in that history. + +A review of the available commit history did not identify a separately attributed non-owner contribution requiring retroactive permission evidence. This is a repository-history review, not a forensic authorship opinion. If later evidence identifies an external contribution, maintainers must review its provenance and record the outcome in `CONTRIBUTION-EXCEPTIONS.md`. + +Existing third-party dependencies, Microsoft runtime content and brand/source assets are governed separately by the dependency, notice and asset records in the repository; they are not treated as contributor-owned merely because they appear in repository or release files. + +## Maintainer process + +Before merging a contribution, maintainers confirm: + +1. the DCO check passes for every non-exempt commit; +2. the pull request contains the required provenance disclosures; +3. third-party terms are known and compatible; +4. any employer/client authority is credible; +5. AI-assisted material has documented human review; +6. any exception has a public decision record and private evidence where necessary. + +Repository or branch settings should require the DCO workflow status before merge. Direct pushes to protected branches should be restricted to maintainers and used only under the same provenance obligations.