python-semantic-release · Copilot · Sep 7, 2026 · Sep 7, 2026
diff --git a/docs/configuration/configuration.rst b/docs/configuration/configuration.rst
@@ -1227,6 +1227,26 @@ raise an error and exit.
 
 ----
 
+.. _config-signoff_commit:
+
+``signoff_commit``
+"""""""""""""""""""
+
+**Type:** ``bool``
+
+When true, Python Semantic Release will add a ``Signed-off-by`` trailer to the version
+commit it creates during :ref:`cmd-version`, using the configured :ref:`config-commit_author`
+name and email. This is equivalent to running ``git commit --signoff`` and is commonly used
+to comply with a `Developer Certificate of Origin`_ (DCO) requirement.
+
+.. _Developer Certificate of Origin: https://developercertificate.org/
+
+This option has no effect when the ``--no-commit`` option is passed.
+
+**Default:** ``false``
+
+----
+
 .. _config-tag_format:
 
 ``tag_format``

diff --git a/src/semantic_release/cli/commands/version.py b/src/semantic_release/cli/commands/version.py
@@ -481,6 +481,7 @@ def version(  # noqa: C901
     commit_message = runtime.commit_message
     major_on_zero = runtime.major_on_zero
     no_verify = runtime.no_git_verify
+    signoff_commit = runtime.signoff_commit
     opts = runtime.global_cli_options
     add_partial_tags = config.add_partial_tags
     gha_output = VersionGitHubActionsOutput(
@@ -713,6 +714,7 @@ def version(  # noqa: C901
                 message=commit_message.format(version=new_version),
                 date=int(commit_date.timestamp()),
                 no_verify=no_verify,
+                signoff=signoff_commit,
                 noop=opts.noop,
             )
         except GitCommitEmptyIndexError:

diff --git a/src/semantic_release/cli/config.py b/src/semantic_release/cli/config.py
@@ -382,6 +382,7 @@ class RawConfig(BaseModel):
     repo_dir: Path = Field(default=cast("Path", "."), validate_default=True)
     remote: RemoteConfig = RemoteConfig()
     no_git_verify: bool = False
+    signoff_commit: bool = False
     tag_format: str = "v{version}"
     add_partial_tags: bool = False
     publish: PublishConfig = PublishConfig()
@@ -635,6 +636,7 @@ class RuntimeContext:
     allow_zero_version: bool
     prerelease: bool
     no_git_verify: bool
+    signoff_commit: bool
     assets: List[str]
     commit_author: Actor
     commit_message: str
@@ -986,6 +988,7 @@ def from_raw_config(  # noqa: C901
             global_cli_options=global_cli_options,
             masker=masker,
             no_git_verify=raw.no_git_verify,
+            signoff_commit=raw.signoff_commit,
         )
         # credential masker
         self.apply_log_masking(self.masker)

diff --git a/src/semantic_release/gitproject.py b/src/semantic_release/gitproject.py
@@ -174,6 +174,7 @@ def git_commit(
         date: int | None = None,
         commit_all: bool = False,
         no_verify: bool = False,
+        signoff: bool = False,
         noop: bool = False,
     ) -> None:
         git_args = dict(
@@ -184,6 +185,7 @@ def git_commit(
                     "m": message,
                     "date": date,
                     "no_verify": no_verify,
+                    "signoff": signoff,
                 }.items(),
             )
         )
@@ -209,6 +211,7 @@ def git_commit(
             command += f"git commit -m '{indented_commit_message}'"
             command += "--all" if commit_all else ""
             command += "--no-verify" if no_verify else ""
+            command += "--signoff" if signoff else ""
 
             noop_report(
                 indented(

diff --git a/tests/e2e/cmd_version/test_version.py b/tests/e2e/cmd_version/test_version.py
@@ -155,6 +155,61 @@ def test_version_no_git_verify(
     assert post_mocker.call_count == 1  # vcs release creation occurred
 
 
+@pytest.mark.parametrize(
+    "repo_result",
+    [lazy_fixture(repo_w_trunk_only_conventional_commits.__name__)],
+)
+def test_version_signoff_commit(
+    repo_result: BuiltRepoResult,
+    run_cli: RunCliFn,
+    update_pyproject_toml: UpdatePyprojectTomlFn,
+    mocked_git_fetch: MagicMock,
+    mocked_git_push: MagicMock,
+    post_mocker: Mocker,
+):
+    """Given signoff_commit is enabled, when a version commit is made, then the commit
+    message includes a Signed-off-by trailer matching the configured commit author."""
+    repo = repo_result["repo"]
+
+    # setup: set configuration setting
+    update_pyproject_toml("tool.semantic_release.signoff_commit", True)
+    repo.git.commit(
+        m="chore: adjust project configuration for signoff release commits", a=True
+    )
+    # Fake an automated push to remote by updating the remote tracking branch
+    repo.git.update_ref(
+        f"refs/remotes/origin/{repo.active_branch.name}",
+        repo.head.commit.hexsha,
+    )
+
+    # Take measurement beforehand
+    head_sha_before = repo.head.commit.hexsha
+    tags_before = {tag.name for tag in repo.tags}
+
+    # Execute
+    cli_cmd = [MAIN_PROG_NAME, VERSION_SUBCMD, "--patch"]
+    result = run_cli(cli_cmd[1:])
+
+    # Take measurement after the command
+    head_after = repo.head.commit
+    tags_after = {tag.name for tag in repo.tags}
+    tags_set_difference = set.difference(tags_after, tags_before)
+
+    # Evaluate (normal release actions should have occurred when forced patch bump)
+    assert_successful_exit_code(result, cli_cmd)
+    assert [head_sha_before] == [head.hexsha for head in head_after.parents]
+    assert len(tags_set_difference) == 1  # A tag has been created
+
+    commit_author = head_after.author
+    assert (
+        f"Signed-off-by: {commit_author.name} <{commit_author.email}>"
+        in head_after.message
+    )
+    assert mocked_git_fetch.call_count == 1  # fetch called to check for remote changes
+    assert mocked_git_push.call_count == 2  # 1 for commit, 1 for tag
+    assert post_mocker.call_count == 1  # vcs release creation occurred
+
+
 @pytest.mark.parametrize(
     "repo_result", [lazy_fixture(repo_w_trunk_only_conventional_commits.__name__)]
 )