ci: gate PRs on AI disclosure and flag unreviewed AI attribution - #728
Merged
Conversation
This repository takes a high volume of external contributions, and a growing share of them arrive with tool attribution still in the description, commits, or branch name, which is a reliable signal that the author never read the diff. Add a pull request template with a mandatory two-box AI disclosure and a pr-hygiene workflow that fails a PR missing the disclosure, and labels, comments on, and fails external PRs carrying AI tool attribution. Contributors with write access are exempt from the attribution scan. AGENTS.md tells agents to mark PR text and commit messages they draft on a contributor's behalf, so a PR opened without the author in the loop is detectable. CONTRIBUTING makes the disclosure mandatory and documents what happens when attribution is left in.
Contributor
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Per-line sed left a checkbox commented out across several lines intact, so a disclosure that does not render could satisfy the required check.
Strip HTML comments across lines so a checked box hidden inside a multiline comment cannot satisfy the disclosure check. Remove a stale ai-unreviewed label when the author turns out to have write access. Use an absolute CONTRIBUTING link in the template since relative links do not resolve from a PR body. Ports the review fixes from solana-foundation/solana-keychain#308.
amilz
approved these changes
Sep 10, 2026
amilz
approved these changes
Sep 10, 2026
amilz
left a comment
amilz
left a comment
Collaborator
There was a problem hiding this comment.
LGTM: adds PR-hygiene CI (AI disclosure gate + attribution scan) and docs; CI green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/PULL_REQUEST_TEMPLATE.mdwith a required two-box AI disclosure, and apr-hygieneworkflow that fails any PR that does not check exactly one box (and, when AI was used, states the tool and extent).ai-unreviewed, commented on once with what to fix, and failed. The label is removed automatically when the attribution is cleaned up.AGENTS.mdtells coding agents to include the canary word in any PR text, commit message, or review reply they draft on a contributor's behalf, which is what makes an unread submission detectable.CONTRIBUTING.md: disclosure is now mandatory rather than "helpful", the PR section points at the template and notes CI enforcement, and the AI use section documents the attribution rule and the "explain every line without an LLM" expectation.Why: this repo takes a high volume of external contributions and a growing share arrive with
Generated with Claude Codefooters,Co-Authored-By: Claudetrailers, orcodex/branches still in place. That is a reliable signal the author never read the diff, and today it is caught by hand, per PR, during review. Ported from solana-foundation/kora#665.Test Plan
actionlint .github/workflows/pr-hygiene.yml: clean.pnpm check(prettier) clean.mainonce merged (pull_request_target), so its live behavior is verified after merge on the next contributor PR.AI disclosure
Check exactly one. See CONTRIBUTING.md.