databricks-sql-kernel 0.1.2__tar.gz

databricks_sql_kernel-0.1.2/.github/CODEOWNERS

@@ -0,0 +1,29 @@
+# CODEOWNERS for databricks-sql-kernel.
+#
+# Patterns are evaluated bottom-to-top per GitHub semantics: the LAST
+# matching rule wins. Keep more-specific rules below more-general ones.
+#
+# All paths below require review from @databricks/eng-oss-sql-driver
+# (enforced by the `protect-main` ruleset's `require_code_owner_review`
+# rule). The team can sub-delegate review via informal channels; the
+# CODEOWNERS file enforces the gate.
+
+# CI workflows and CI configuration.
+.github/workflows/         @databricks/eng-oss-sql-driver
+.github/dependabot.yml     @databricks/eng-oss-sql-driver
+.github/actions/           @databricks/eng-oss-sql-driver
+
+# Self-referential: CODEOWNERS edits require team approval (prevents
+# silent weakening of the rule set).
+.github/CODEOWNERS         @databricks/eng-oss-sql-driver
+
+# Cargo dependency graph + license-policy gate. Adding a new crate
+# or relaxing license rules is a security-relevant change.
+/Cargo.toml                @databricks/eng-oss-sql-driver
+/Cargo.lock                @databricks/eng-oss-sql-driver
+/deny.toml                 @databricks/eng-oss-sql-driver
+/about.toml                @databricks/eng-oss-sql-driver
+
+# PyO3 sub-crate manifests — pip / Python dep changes flow through here.
+/pyo3/Cargo.toml           @databricks/eng-oss-sql-driver
+/pyo3/pyproject.toml       @databricks/eng-oss-sql-driver

databricks_sql_kernel-0.1.2/.github/actions/setup-jfrog/action.yml

@@ -0,0 +1,142 @@
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Configure JFrog Artifactory as the registry proxy for cargo / uv /
+# (future) npm. Required by go/hardened-gha: direct access to public
+# package registries (crates.io, pypi.org, etc.) is blocked at the
+# Databricks-protected runner; everything goes through
+# `databricks.jfrog.io`.
+#
+# Steps:
+#
+# 1. Exchange the workflow's GitHub OIDC ID token for a JFrog access
+#    token via `https://databricks.jfrog.io/access/api/v1/oidc/token`.
+# 2. Optionally write `~/.cargo/config.toml` pointing at the JFrog
+#    cargo proxy (`db-cargo-remote`). Replaces direct crates.io
+#    access for `cargo fetch` / `cargo install` / `cargo deny check`.
+# 3. Optionally export `UV_INDEX_URL` (and `PIP_INDEX_URL` for
+#    fallback compat) pointing at the JFrog PyPI proxy (`db-pypi`).
+#    Picked up by `uv sync` / `uv pip install` / any plain `pip`
+#    calls in the job.
+#
+# Calling workflows MUST add `permissions: id-token: write` to grant
+# the OIDC mint capability; without it the curl in step 1 fails 403.
+#
+# Reference: go/hardened-gha
+#   https://docs.google.com/document/d/1zoHgolfZO_IUBIU3w40NmYsoZ9eTRdAmjlfwYOxkj70
+
+name: Set up JFrog Artifactory access
+description: |
+  Exchange GitHub OIDC for a JFrog token and (optionally) configure
+  cargo / uv to route through the Databricks JFrog proxy.
+
+inputs:
+  cargo:
+    description: "Set 'true' to configure cargo to use the JFrog crates proxy."
+    required: false
+    default: "false"
+  uv:
+    description: |
+      Set 'true' to export UV_INDEX_URL (and PIP_INDEX_URL for compat)
+      pointing at the JFrog PyPI proxy. uv reads UV_INDEX_URL natively;
+      PIP_INDEX_URL is set for any tool that falls back to pip.
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Get JFrog OIDC token
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        # Mint a GitHub OIDC ID token scoped to the `jfrog-github`
+        # audience. Requires `permissions: id-token: write` on the
+        # calling job.
+        ID_TOKEN=$(curl -sLS \
+          -H "User-Agent: actions/oidc-client" \
+          -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+          "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" | jq .value | tr -d '"')
+        echo "::add-mask::${ID_TOKEN}"
+
+        # Exchange for a JFrog access token (RFC 8693 token-exchange).
+        ACCESS_TOKEN=$(curl -sLS -XPOST -H "Content-Type: application/json" \
+          "https://databricks.jfrog.io/access/api/v1/oidc/token" \
+          -d "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${ID_TOKEN}\", \"provider_name\": \"github-actions\"}" | jq .access_token | tr -d '"')
+        echo "::add-mask::${ACCESS_TOKEN}"
+
+        if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then
+          echo "FAIL: Could not extract JFrog access token"
+          exit 1
+        fi
+
+        echo "JFROG_ACCESS_TOKEN=${ACCESS_TOKEN}" >> "$GITHUB_ENV"
+        echo "JFrog OIDC token obtained successfully"
+
+    - name: Configure cargo to use JFrog
+      if: inputs.cargo == 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        mkdir -p ~/.cargo
+        cat > ~/.cargo/config.toml << 'EOF'
+        [source.crates-io]
+        replace-with = "jfrog"
+
+        [source.jfrog]
+        registry = "sparse+https://databricks.jfrog.io/artifactory/api/cargo/db-cargo-remote/index/"
+
+        [registries.jfrog]
+        index = "sparse+https://databricks.jfrog.io/artifactory/api/cargo/db-cargo-remote/index/"
+        credential-provider = ["cargo:token"]
+        EOF
+
+        cat > ~/.cargo/credentials.toml << EOF
+        [registries.jfrog]
+        token = "Bearer ${JFROG_ACCESS_TOKEN}"
+        EOF
+        chmod 600 ~/.cargo/credentials.toml
+
+        # NOTE: we deliberately do NOT export CARGO_REGISTRIES_JFROG_TOKEN
+        # into $GITHUB_ENV. cargo (and tools that shell out to it —
+        # cargo-deny, cargo-llvm-cov) read the token from the
+        # ~/.cargo/credentials.toml written above via the
+        # `credential-provider = ["cargo:token"]` line in config.toml,
+        # so the env var was redundant. Critically, the token is
+        # regenerated on every run, and Swatinem/rust-cache (run by
+        # actions-rust-lang/setup-rust-toolchain) hashes every
+        # `CARGO*`-prefixed env var into its cache key — so exporting a
+        # fresh token here gave every run a unique key and a guaranteed
+        # cache miss (full cold rebuild of the ~57-crate tree in every
+        # job). Keeping the token in the credentials file only restores
+        # stable cache keys and warm builds.
+
+        echo "Cargo configured to use JFrog registry"
+
+    - name: Configure uv / pip to use JFrog
+      if: inputs.uv == 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        # uv reads UV_INDEX_URL natively; PIP_INDEX_URL is set for
+        # fallback compatibility with tools that shell out to pip.
+        # Both URLs point at db-pypi via the JFrog OIDC service
+        # account.
+        INDEX_URL="https://gha-service-account:${JFROG_ACCESS_TOKEN}@databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple"
+        echo "UV_INDEX_URL=${INDEX_URL}" >> "$GITHUB_ENV"
+        echo "PIP_INDEX_URL=${INDEX_URL}" >> "$GITHUB_ENV"
+        echo "uv / pip configured to use JFrog registry"

databricks_sql_kernel-0.1.2/.github/dependabot.yml

@@ -0,0 +1,70 @@
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Dependabot configuration for the kernel.
+#
+# Ecosystems intentionally covered:
+#   - cargo: keeps the Rust crate graph patched, complements
+#     `cargo-deny` (RustSec advisories already block merges).
+#   - github-actions: keeps the SHA-pinned actions current.
+#
+# Ecosystems intentionally NOT covered:
+#   - pip: per go/pinning-python-deps the kernel is an
+#     externally-published library; we use major-version bounds in
+#     pyo3/pyproject.toml + `uv sync` re-resolution per CI run, with
+#     no committed lockfile. Letting Dependabot rewrite pinned pip
+#     versions would conflict with that policy.
+
+version: 2
+updates:
+  # Root workspace (kernel + the pyo3 member, which share the root
+  # Cargo.lock).
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      # Batch patch + minor updates to reduce PR churn; security
+      # advisories still come through as individual PRs.
+      cargo-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # napi/ is a standalone Cargo workspace with its own committed
+  # Cargo.lock (napi CI builds with `--locked`). The root entry above
+  # does not see it, so without this entry napi's transitive deps
+  # never get security / version bumps.
+  - package-ecosystem: "cargo"
+    directory: "/napi"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      napi-cargo-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      gha-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"

databricks_sql_kernel-0.1.2/.github/workflows/cargo-publish.yml

@@ -0,0 +1,125 @@
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Publishes the kernel crate to Databricks's internal Cargo registry
+# (db-cargo-remote, fronted by JFrog Artifactory). Triggered by:
+#
+#   1. Pushing a `v*` git tag (e.g. `v0.1.0`) — the canonical release path.
+#   2. Manual `workflow_dispatch` from the Actions tab — for ad-hoc test
+#      publishes or re-running after a transient failure.
+#
+# Downstream consumer: `databricks-eng/universe` pulls the kernel via
+# `third_party/rust/BUILD.bazel`'s `crates_vendor` packages dict,
+# referencing it like any other crates.io dep (mirrors how
+# `databricks-zerobus-ingest-sdk` is consumed). See universe PR
+# https://github.com/databricks-eng/universe/pull/2006687 for the
+# initial consumer wiring.
+#
+# Why this workflow exists: the same JFrog proxy this repo already
+# uses to FETCH dependencies (via `.github/actions/setup-jfrog`) can
+# also receive `cargo publish` uploads — they route to the local
+# backing repo in the virtual `db-cargo-remote`. The OIDC token
+# exchange grants both read and write scopes by default for the
+# `jfrog-github` audience.
+
+name: Cargo Publish
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Run `cargo publish --dry-run` instead of an actual publish"
+        required: false
+        default: "false"
+
+concurrency:
+  # Serialize publishes — Artifactory rejects concurrent uploads of
+  # the same crate-version pair, and a concurrent dry-run + real run
+  # could leave the registry in a confusing state.
+  group: ${{ github.repository }}-cargo-publish
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  # Required for the OIDC token exchange that the
+  # `.github/actions/setup-jfrog` composite uses. See go/hardened-gha.
+  id-token: write
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  publish:
+    name: cargo publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          # Tag-triggered runs need full history-of-the-tag's commit only;
+          # depth=1 keeps the checkout small.
+          fetch-depth: 1
+
+      - name: Configure JFrog Artifactory access
+        uses: ./.github/actions/setup-jfrog
+        with:
+          cargo: "true"
+
+      - name: Set up Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@9d7e65c320fdb52dcd45ffaa68deb6c02c8754d9 # v1.13.0
+
+      # Sanity-check the tag-vs-Cargo.toml-version alignment so a typo
+      # in the tag (`v0.1.0` vs Cargo.toml `0.1.1`) fails loudly here
+      # rather than producing a mismatched-name release. Only runs on
+      # tag-triggered builds; manual workflow_dispatch skips the check.
+      - name: Verify tag matches Cargo.toml version
+        if: github.event_name == 'push'
+        run: |
+          set -euo pipefail
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
+          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
+            echo "FAIL: tag $GITHUB_REF_NAME (=> $TAG_VERSION) does not match Cargo.toml version $CARGO_VERSION"
+            exit 1
+          fi
+          echo "Tag and Cargo.toml version both at $CARGO_VERSION"
+
+      - name: cargo publish
+        env:
+          # The `setup-jfrog` action exports CARGO_REGISTRIES_JFROG_TOKEN
+          # into GITHUB_ENV for tools that read env directly; cargo
+          # publish picks it up automatically via the credential-provider
+          # config the action writes to ~/.cargo/credentials.toml.
+          CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+        run: |
+          set -euo pipefail
+          DRY_RUN_FLAG=""
+          if [ "${{ github.event.inputs.dry_run || 'false' }}" = "true" ]; then
+            DRY_RUN_FLAG="--dry-run"
+            echo "DRY RUN — no actual publish will happen"
+          fi
+          # `--registry jfrog` matches the `[registries.jfrog]` block
+          # that setup-jfrog writes into ~/.cargo/config.toml. The
+          # workspace's other members (pyo3/) have their own publish
+          # workflows / are not part of this release; --no-verify
+          # skips re-compiling the crate during the package step
+          # since CI has already done that elsewhere.
+          cargo publish \
+            --registry jfrog \
+            --package databricks-sql-kernel \
+            $DRY_RUN_FLAG

databricks_sql_kernel-0.1.2/.github/workflows/close-stale.yml

@@ -0,0 +1,46 @@
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Port of databricks/databricks-jdbc's closeStale.yml. Closes issues
+# and PRs after 30 days of inactivity (with a 7-day stale window).
+
+name: Close stale issues and PRs
+
+on:
+  schedule:
+    # 06:30 UTC daily
+    - cron: "30 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    name: Close stale issues and PRs
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+    steps:
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899  # v10.3.0
+        with:
+          stale-issue-message: "This issue has been marked as Stale because it has been open for 30 days with no activity. If you would like the issue to remain open, please remove the stale label or comment on the issue."
+          stale-pr-message: "This PR has been marked as Stale because it has been open for 30 days with no activity. If you would like the PR to remain open, please remove the stale label or comment on the PR."
+          close-pr-message: "This PR was closed because it has been inactive for 7 days since being marked as stale."
+          close-issue-message: "This issue was closed because it has been inactive for 7 days since being marked as stale."
+          days-before-stale: 30
+          days-before-close: 7
+          exempt-issue-labels: "epic, discussion, kernel-v0, tracked"
+          exempt-pr-labels: "kernel-v0, tracked"

databricks_sql_kernel-0.1.2/.github/workflows/coverage.yml

@@ -0,0 +1,104 @@
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Code coverage report. Runs `cargo llvm-cov` against the unit /
+# integration test suite (E2E tests stay #[ignore]'d) and uploads
+# the lcov result to Codecov via OIDC.
+
+name: Coverage
+
+on:
+  push:
+    branches: [main]
+    # Path-filtered: a full instrumented rebuild (`cargo llvm-cov`) is
+    # expensive, so only run it when something that can move the
+    # coverage number changes. Docs / workflow-only PRs skip it.
+    paths:
+      - "src/**"
+      - "tests/**"
+      - "pyo3/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/coverage.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "src/**"
+      - "tests/**"
+      - "pyo3/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/coverage.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  coverage:
+    name: Coverage
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - uses: ./.github/actions/setup-jfrog
+        with:
+          cargo: "true"
+
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6  # v1.16.1
+        with:
+          toolchain: stable
+          components: llvm-tools-preview
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@e0eafa9a0d485c37f97c0f7beb930a58a2facbac  # v2.79.4
+        with:
+          tool: cargo-llvm-cov
+
+      - name: Run coverage
+        # E2E tests stay #[ignore]'d; coverage runs the same suite
+        # as `pr-checks.yml`'s `test` job.
+        run: cargo llvm-cov --workspace --lcov --output-path lcov.info
+
+      # Codecov upload.
+      #
+      # `use_oidc: true` is tokenless, but it requires the repo to be
+      # enrolled in Codecov's GitHub App with OIDC enabled in the
+      # Codecov dashboard. Until that is set up, the action falls
+      # back to anonymous upload which Codecov silently rate-limits
+      # and may drop. `fail_ci_if_error: false` keeps the job green
+      # in that case (we don't want a one-off Codecov outage to red-
+      # light unrelated PRs) — but it does mean coverage data may not
+      # actually land. Watch for the Codecov check on the first few
+      # PRs to confirm uploads are flowing.
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354  # v6.0.1
+        with:
+          files: lcov.info
+          fail_ci_if_error: false
+          use_oidc: true

databricks_sql_kernel-0.1.2/.github/workflows/dco-check.yml

@@ -0,0 +1,92 @@
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Verbatim port of the dco-check workflow used across the other
+# databricks/databricks-sql-* repos. Enforces `git commit -s` sign-off
+# on every commit in a PR — CLAUDE.md mandates this convention.
+
+name: DCO Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dco-check:
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+    name: Check DCO Sign-off
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Check DCO Sign-off
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          #!/bin/bash
+          set -e
+
+          echo "Checking commits from $BASE_SHA to $HEAD_SHA"
+
+          COMMITS=$(git rev-list --no-merges "$BASE_SHA..$HEAD_SHA")
+
+          if [ -z "$COMMITS" ]; then
+            echo "No commits found in this PR"
+            exit 0
+          fi
+
+          FAILED_COMMITS=()
+
+          for commit in $COMMITS; do
+            echo "Checking commit: $commit"
+            COMMIT_MSG=$(git log --format=%B -n 1 "$commit")
+            if echo "$COMMIT_MSG" | grep -q "^Signed-off-by: "; then
+              echo "  Commit $commit has DCO sign-off"
+            else
+              echo "  Commit $commit is missing DCO sign-off"
+              FAILED_COMMITS+=("$commit")
+            fi
+          done
+
+          if [ ${#FAILED_COMMITS[@]} -ne 0 ]; then
+            echo ""
+            echo "DCO Check Failed!"
+            echo "The following commits are missing the required 'Signed-off-by' line:"
+            for commit in "${FAILED_COMMITS[@]}"; do
+              echo "  - $commit: $(git log --format=%s -n 1 "$commit")"
+            done
+            echo ""
+            echo "To fix this, you need to sign off your commits. You can:"
+            echo "1. Add sign-off to new commits: git commit -s -m 'Your commit message'"
+            echo "2. Amend existing commits: git commit --amend --signoff"
+            echo "3. For multiple commits, use: git rebase --signoff HEAD~N (where N is the number of commits)"
+            echo ""
+            echo "The sign-off should be in the format:"
+            echo "Signed-off-by: Your Name <your.email@example.com>"
+            echo ""
+            echo "For more details, see CONTRIBUTING.md"
+            exit 1
+          else
+            echo ""
+            echo "All commits have proper DCO sign-off!"
+          fi