[ci-maintainer] Tide squash on v4 drops or mismatches Signed-off-by, so v4 history fails DCO and every v4->v5 sync inherits it

[clubanderson]

Symptom

Sync PR #6309 (96 v4 commits merged into v5) fails the probot DCO check with "25 commits incorrectly signed off" and Prow's dco plugin labels it dco-signoff: no. None of those commits are new: they are v4 squash commits produced by Tide. The previous sync #6046 had 17 of 100 in the same state and was only merged by hand-swapping the dco-signoff label, which is a DCO bypass and should not become the routine.

Two shapes:

1. Author/sign-off name mismatch: the squash commit's author is Andrew Anderson <andan02@gmail.com> while the retained trailer reads Signed-off-by: Andy Anderson <andy@clubanderson.com> (24 commits).
2. Trailer dropped entirely: 18e7dcd7 (🐛 fix(github): refuse an unsubstituted prompt placeholder as a repo name #6243) has no Signed-off-by although every commit on the PR branch was signed.

Cause

Tide's squash builds the commit from the PR title/body and the PR author's identity, not from the branch's signed commits, so the trailer that DCO expects either does not survive or no longer matches the author line it is checked against.

Ask

• Configure Tide's squash commit template for v4/v5 to carry a Signed-off-by: trailer that matches the squash commit's author identity (or make Tide merge with --no-ff / rebase for signed branches), so every commit that lands on a protected branch passes DCO on its own.
• Add a post-merge check (coverage-hourly style) that runs the DCO check on the last N commits of v4/v5 and opens an issue when one fails, so a bad squash is caught before the next sync.
• Until then, document in src/docs/v5-sync-policy.md what the maintainer does with inherited DCO failures instead of relabelling by hand.

Related: #6251 (bracketed bot email rejected by probot), #6276 (fix for that on v4), #6309 (current sync).

🤖 Generated with Claude Code

https://claude.ai/code/session_01TmdVsn5zULh5KVpFkYrX59