update contributing and add PR template (#87)

Signed-off-by: JJ Kasper <jj@jjsweb.site>

.github/dco.yml

@@ -0,0 +1,4 @@
+require:
+  members: true
+allowRemediationCommits:
+  individual: true

.github/pull_request_template.md

@@ -0,0 +1,14 @@
+### Description
+
+<!-- Write a short summary of the problem and solution. -->
+
+### How did you test your changes?
+
+<!-- Include the commands you ran and any manual coverage. -->
+
+### PR Checklist
+
+- [ ] I ran the relevant checks from `CONTRIBUTING.md`
+- [ ] I added tests and documentation where relevant
+- [ ] I added a changeset if this touches the published `eve` package
+- [ ] DCO sign-off passes for every commit (`git commit --signoff`)

CONTRIBUTING.md

@@ -2,6 +2,22 @@
 
 Thanks for your interest in contributing! This guide covers everything you need to get the repo running locally and land a change.
 
+## Signed commits
+
+This repository requires verified commit signatures on protected branches.
+
+Before contributing, configure Git to sign your commits with a GitHub-verified
+GPG, SSH, or S/MIME key. Unsigned commits will be rejected by repository rules
+and need to be rewritten as signed commits before they can be merged.
+
+If a pull request includes unsigned commits, re-sign the commits and force-push
+the branch. Make sure the signing key is added to your GitHub account and that
+your commits appear as `Verified`.
+
+A `Signed-off-by` line in the commit message is not enough to satisfy this
+requirement. A verified commit signature alone does not satisfy the DCO either;
+commits need both.
+
 ## Prerequisites
 
 - **Node.js 24+** — see [`.nvmrc`](./.nvmrc) (`nvm use` or `fnm use`)
@@ -84,17 +100,54 @@ User-facing docs live in [`docs/`](./docs) and are published with the `eve` npm
 
 1. Fork the repo and create a branch from `main`.
 2. Make your change, including tests and docs where relevant.
-3. If the change affects the published `eve` package, add a changeset:
+3. Sign off every commit with `git commit -s`.
+4. If the change affects the published `eve` package, add a changeset:
 
    ```bash
    pnpm changeset
    ```
 
-4. Make sure `pnpm lint`, `pnpm typecheck`, and `pnpm test` pass.
-5. Open the PR with a clear description of the problem and solution.
+5. Make sure `pnpm lint`, `pnpm typecheck`, and `pnpm test` pass.
+6. Open the PR with a clear description of the problem and solution.
 
 Releases are managed with [Changesets](https://github.com/changesets/changesets) by the maintainers.
 
+## Developer Certificate of Origin (DCO)
+
+We do not require a CLA. Instead, all contributions are made under the
+[Developer Certificate of Origin (DCO)](./DCO.txt), a lightweight, one-line
+attestation that you have the right to submit your contribution under the
+project's license. There is nothing to sign and no account to create.
+
+Every commit must include a `Signed-off-by` line matching the commit author's
+name and email:
+
+```text
+Signed-off-by: Jane Doe <jane.doe@example.com>
+```
+
+Add it automatically with:
+
+```bash
+git commit -s -m "your commit message"
+```
+
+If you forget, amend the last commit:
+
+```bash
+git commit --amend -s --no-edit
+```
+
+To sign off a series of commits, rebase with `--signoff`:
+
+```bash
+git rebase --signoff main
+```
+
+The sign-off requirement applies to all contributors, including Vercel
+employees. A required check blocks pull requests that contain commits without a
+valid sign-off.
+
 ## Reporting bugs and requesting features
 
 Please use the [issue templates](https://github.com/vercel/eve/issues/new/choose). For security issues, **do not open a public issue** — follow [SECURITY.md](./SECURITY.md) instead.
@@ -105,4 +158,6 @@ This project follows the [Code of Conduct](./CODE_OF_CONDUCT.md). By participati
 
 ## License
 
-By contributing, you agree that your contributions will be licensed under the [Apache License 2.0](./LICENSE).
+`eve` is licensed under the [Apache License 2.0](./LICENSE). By contributing,
+you agree that your contributions will be licensed under that same license
+(inbound = outbound).

DCO.txt

@@ -0,0 +1,37 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+1 Letterman Drive
+Suite D4700
+San Francisco, CA, 94129
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.