Licence, contributor agreement and sign-off check

.github/workflows/contributor-agreement.yml

@@ -0,0 +1,68 @@
+# The contributor agreement (CONTRIBUTING.md): every commit in a pull
+# request carries a "Signed-off-by:" line with its author's email, which
+# says the author agrees to it for that commit.  Merge commits are
+# skipped.  Pull requests opened by the repository's owner or the D-Modem
+# organization's members, and by bots, are not checked.  Nor are commits
+# by Claude (noreply@anthropic.com) on a branch of this repository: only
+# those who can push here can put them there, and the owner takes them in
+# by merging (a fork's commits with that email are still checked).
+#
+# pull_request_target, so that the check is the base branch's copy and a
+# pull request can't change it.  It reads the commits through the API and
+# never checks out or runs the pull request's code.
+name: Contributor agreement
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+
+concurrency:
+  group: contributor-agreement-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  sign-off:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/github-script@v8
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const exempt = ['OWNER', 'MEMBER'];
+            if (pr.user.type === 'Bot' || exempt.includes(pr.author_association)) {
+              core.info(`Opened by ${pr.user.login} (${pr.author_association}): not checked.`);
+              return;
+            }
+            const commits = await github.paginate(github.rest.pulls.listCommits, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.number,
+              per_page: 100,
+            });
+            const sameRepo = pr.head.repo && pr.head.repo.full_name === pr.base.repo.full_name;
+            const exemptAuthors = ['noreply@anthropic.com'];
+            const missing = [];
+            for (const c of commits) {
+              if (c.parents.length > 1) continue;
+              const email = (c.commit.author.email || '').toLowerCase();
+              if (sameRepo && exemptAuthors.includes(email)) continue;
+              const signed = [...c.commit.message.matchAll(/^Signed-off-by:.*<([^>]+)>\s*$/gim)]
+                .some(m => m[1].trim().toLowerCase() === email);
+              if (!signed) {
+                missing.push(`${c.sha.slice(0, 7)} ${c.commit.message.split('\n')[0]} (author ${email})`);
+              }
+            }
+            if (missing.length) {
+              core.setFailed(
+                'These commits have no "Signed-off-by:" line with their author\'s email, ' +
+                'which says you agree to the contributor agreement in CONTRIBUTING.md:\n  ' +
+                missing.join('\n  ') +
+                '\n\nTo add it: git rebase --signoff ' + pr.base.ref +
+                ' (or git commit --amend -s for the last commit), then force-push.');
+            } else {
+              core.info(`All ${commits.length} commits are signed off.`);
+            }

COMMERCIAL-LICENSE.md

@@ -0,0 +1,44 @@
+# Commercial license
+
+The D-Modem website is Copyright (C) 2026 D-Modem Authors and is offered
+under two licenses; you choose one.
+
+## The GNU Affero General Public License, version 3 (the default)
+
+[LICENSE](LICENSE), AGPL-3.0-only.  Free of charge, for any purpose,
+commercial ones included, on the AGPL's terms.  In short:
+
+- If you distribute the D-Modem website, modified or not, you give the recipients
+  its complete source code under the AGPL.
+- If you modify the D-Modem website and let people use it remotely (anyone using it
+  over a network), you offer those users
+  the complete source code of your modified version under the AGPL
+  (section 13).
+
+## A commercial license
+
+For those who cannot or will not meet the AGPL's terms, for example to:
+
+- ship the D-Modem website, or a modified version, inside a product whose source
+  you do not publish;
+- run a modified version of the D-Modem website as a service without offering its source to
+  the people who use it;
+- combine it with code under licenses that do not mix with the AGPL.
+
+A commercial license is granted by the D-Modem Authors, the copyright holders,
+on terms agreed with you (scope, term and fee).
+
+Neo-Desktop (<https://github.com/Neo-Desktop>) is the point of contact
+for commercial licenses.
+
+**To ask for one**, contact Neo-Desktop, or open an issue at
+<https://github.com/D-Modem/D-Modem.github.io/issues> titled "Commercial
+license", saying who you are and roughly what you want to do.  Keep
+anything confidential out of the issue: a private channel follows from
+there.
+
+Until a commercial license is signed, the AGPL is the only license you
+have.
+
+This file explains the licensing; it is not itself a license or a
+contract.

CONTRIBUTING.md

@@ -0,0 +1,58 @@
+# Contributing
+
+Contributions are welcome: issues, fixes and features alike.  Before
+sending a change, preview the site ([README.md](README.md)).
+
+## The contributor agreement
+
+The site is offered under the AGPL-3.0 and, by the D-Modem Authors, under
+commercial licenses ([COMMERCIAL-LICENSE.md](COMMERCIAL-LICENSE.md)).
+For contributions to be part of both, each one comes with this agreement.
+By submitting a contribution (a pull request, a patch or
+any other code or text meant for inclusion), you agree that:
+
+1. The contribution is your own original work, or you otherwise have
+   the right to submit it under these terms, and to your knowledge it
+   infringes no one's rights.  If your employer has rights in what you
+   create, you have its permission to contribute, or it has waived those
+   rights.
+2. You assign to D-Modem all copyright in your contribution, worldwide,
+   for the whole term of those rights.  "D-Modem" here is the D-Modem
+   organization (<https://github.com/D-Modem>), whose rights its owner,
+   Neo-Desktop, holds on its behalf; the "D-Modem Authors" in the
+   project's copyright notices are D-Modem in this sense.  Where a right
+   can't be assigned (moral rights, for example), you waive it, or where
+   it can't be waived, you agree not to assert it against D-Modem or
+   those who receive the project from it.  If the assignment is not
+   effective anywhere, you instead grant D-Modem there an exclusive,
+   perpetual, worldwide, no-charge, royalty-free, irrevocable license to
+   do anything the copyright holder could do with your contribution,
+   including licensing it to others.
+3. D-Modem may license your contribution, and works based on it, under
+   the AGPL-3.0 and under any other terms, commercial licenses included.
+   It licenses your contribution back to you: a perpetual, worldwide,
+   non-exclusive, no-charge, royalty-free, irrevocable license to use,
+   copy, modify, publicly display and perform, sublicense and distribute
+   it, on any terms.
+4. You grant D-Modem, and those who receive the project from it, a
+   perpetual, worldwide, non-exclusive, no-charge, royalty-free,
+   irrevocable license under any patent claims of yours that your
+   contribution would infringe, to make, use, sell and otherwise
+   transfer it as part of the project.
+5. Your contribution is provided "as is", without warranties or
+   conditions of any kind.
+
+Please add this line to each commit you contribute (`git commit -s`
+does it):
+
+    Signed-off-by: Your Name <your@email>
+
+It says that you agree to the above for that commit.  A contribution
+without it cannot be merged.
+
+A check on each pull request looks for that line, with the commit
+author's email, on every commit.  If it's missing, `git rebase --signoff
+main` (or `git commit --amend -s` for the last commit) adds it; then
+force-push.  Pull requests from the D-Modem Authors themselves (the
+repository's owner and the D-Modem organization's members) are not
+checked.