feat: option to signoff commits done by python-semantic-release #1441

Feature Request

Description

Add support for automatically including a Signed-off-by line in all Git commits created by python-semantic-release.
This enables release commits (version bumps, changelog commits, etc.) to comply with Developer Certificate of Origin (DCO) requirements by appending the standard signoff trailer generated by git commit --signoff.

Use cases

• Projects enforcing the DCO (Developer Certificate of Origin).
• Teams requiring all commits — including automated release commits — to include a Signed-off-by: trailer.
• CI/CD pipelines that validate commits using DCO bots or tools like dco-check or git-validate.
• Ensuring semantic-release–generated commits do not violate merge policies requiring signoff.

Possible implementation

• Add a configuration option, e.g.:
  • git_signoff: bool
• When enabled, semantic-release should behave as if git commit --signoff was used for all generated commits.
• Implementation ideas:
  • Extend the GitPython commit call to append the signoff trailer.
  • Or use the Git CLI directly to create commits with --signoff when the option is enabled.
  • or add a placeholder {commit_author} to the commit message(configured commit_message) so that users add the siging line manually
• The signoff line should follow the standard format:

  Signed-off-by: <author name> <author email>
  

  using py-semantic release's configured commit_author
• Ensure compatibility with CI environments where Git identity must be set explicitly.

Alternative solutions

• Manually amending commits after semantic-release runs, which breaks automation and reproducibility.
• Wrapping semantic-release in a script that adds signoff afterward, which is fragile and may interfere with tagging or changelog generation.
• Disabling DCO checks for automated commits, which is often not acceptable for compliance or governance reasons.
• Adding the signoff line directly in the configured commit_message.
  This only works when commit_author is statically configured.
  It fails when the author is overridden via CLI flags or environment variables, because the signoff line must match the actual commit author to satisfy DCO validation. Therefore, this approach is unreliable and cannot guarantee compliance.