chore(hooks): enforce Signed-off-by line in commit messages

Add a commit-msg hook that requires a Signed-off-by line in all commit
messages. This promotes contributor accountability and compliance with
developer sign-off policies. Contributors are encouraged to use the
`git commit -s` flag for all commits.

Note: This hook does not verify if the commit is cryptographically signed;
such validation should be performed in a post-commit hook if required.

Signed-off-by: Gil Levkovich <[email protected]>

Author: glevkovich

.pre-commit-config.yaml

@@ -14,6 +14,11 @@ repos:
         entry: contrib/scripts/conventional-commits
         language: script
         stages: [commit-msg]
+      - id: signed-commit
+        name: Signed Commit Enforcer
+        entry: contrib/scripts/signed-commit
+        language: script
+        stages: [commit-msg]
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.3.0

.pre-commit-hooks.yaml

@@ -4,4 +4,12 @@
   language: script
   description: Conventional Commits Enforcement at the `git commit` client-side level
   always_run: true
-  stages: [commit-msg]
+  stages: [commit-msg]
+
+- id: signed-commit
+  name: Signed Commit Enforcer
+  entry: contrib/scripts/signed-commit
+  language: script
+  description: Ensures all commits contain a Signed-off-by line
+  always_run: true
+  stages: [commit-msg]

contrib/scripts/signed-commit

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+if [[ -z "$1" ]] || [[ ! -f "$1" ]]; then
+  echo "ERROR: Commit message file not provided or does not exist."
+  exit 1
+fi
+
+# Check if signed-off-by line is present (automatically added using -s flag)
+if ! grep -q 'Signed-off-by:' "$1"; then
+  echo "ERROR: Commit message must contain a Signed-off-by line."
+  echo ""
+  echo "To sign your commits, use the -s flag:"
+  echo "  git commit -s -m \"your commit message\""
+  exit 1
+fi
+
+exit 0