Skip to content

Commit 48dd04b

Browse files
AndyScherzingerAndyScherzinger
committed
docs: Add AI policy check
Assisted-by: Claude Code:claude-sonnet-4-6 Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
1 parent 2dc52cd commit 48dd04b

3 files changed

Lines changed: 363 additions & 0 deletions

File tree

‎.github/workflows/ai-policy.yml‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
# This workflow is provided via the organization template repository
2+
#
3+
# https://github.com/nextcloud/.github
4+
# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
5+
#
6+
# SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
7+
# SPDX-License-Identifier: MIT
8+
9+
name: AI Policy
10+
11+
on:
12+
pull_request:
13+
types: [opened, synchronize, reopened]
14+
branches: [master, main]
15+
16+
permissions:
17+
contents: read
18+
# Required to add the "AI assisted" label via `gh pr edit --add-label`
19+
pull-requests: write
20+
# Required to create the "AI assisted" label via the REST labels endpoint
21+
# (labels are an issues-scoped resource in the GitHub API)
22+
issues: write
23+
24+
concurrency:
25+
group: ai-policy-${{ github.head_ref || github.run_id }}
26+
cancel-in-progress: true
27+
28+
jobs:
29+
check-ai-trailers:
30+
runs-on: ubuntu-latest
31+
steps:
32+
- name: Checkout
33+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
34+
with:
35+
fetch-depth: 0
36+
persist-credentials: false
37+
38+
- name: Collect PR commit messages
39+
id: collect
40+
env:
41+
BASE_REF: ${{ github.base_ref }}
42+
run: |
43+
set -euo pipefail
44+
git fetch origin "${BASE_REF}"
45+
MERGE_BASE=$(git merge-base "origin/${BASE_REF}" HEAD)
46+
git log --format="%B" "${MERGE_BASE}..HEAD" > /tmp/pr_commits.txt
47+
echo "--- PR commit messages ---"
48+
cat /tmp/pr_commits.txt
49+
echo "--------------------------"
50+
51+
- name: Define shared agent detection patterns
52+
run: |
53+
set -euo pipefail
54+
55+
# Email addresses known to be used by coding agents.
56+
# These should never appear in Signed-off-by because the DCO can only be attested by a human.
57+
EMAIL_PATTERN="copilot@github\.com\
58+
|noreply@anthropic\.com\
59+
|devin@cognition\.ai\
60+
|devin@cognition-labs\.com\
61+
|aider@aider\.chat\
62+
|noreply@aider\.chat\
63+
|codex@openai\.com\
64+
|cursor@anysphere\.com\
65+
|windsurf@codeium\.com\
66+
|codeium@codeium\.com\
67+
|amazon-q@amazon\.com\
68+
|codewhisperer@amazon\.com\
69+
|gemini-code-assist@google\.com\
70+
|openhands@all-hands\.dev\
71+
|swe-agent@princeton\.edu"
72+
73+
# Strip embedded whitespace (used above only for readability)
74+
EMAIL_PATTERN=$(echo "$EMAIL_PATTERN" | tr -d ' \n')
75+
echo "AGENT_EMAIL_PATTERN=${EMAIL_PATTERN}" >> "$GITHUB_ENV"
76+
77+
# Display-name prefixes used by known coding agents (shared by Signed-off-by and Co-Authored-By checks)
78+
# shellcheck disable=SC2016
79+
echo 'AGENT_NAMES=GitHub Copilot|Claude( [A-Za-z0-9. -]+)?|Devin( AI)?|aider( \(.*\))?|OpenAI Codex|Cursor( AI)?|Windsurf|Amazon Q|CodeWhisperer|Gemini Code Assist|OpenHands|SWE-agent|AutoCodeRover|Tabnine' >> "$GITHUB_ENV"
80+
81+
- name: Check for AI-assistant / Assisted-by trailers
82+
id: ai_trailers
83+
run: |
84+
set -euo pipefail
85+
AI_ASSISTED=false
86+
if grep -qiE '^(AI-assistant|Assisted-by):' /tmp/pr_commits.txt; then
87+
AI_ASSISTED=true
88+
echo "Found AI-assistant/Assisted-by trailer(s):"
89+
grep -iE '^(AI-assistant|Assisted-by):' /tmp/pr_commits.txt
90+
fi
91+
echo "ai_assisted=${AI_ASSISTED}" >> "$GITHUB_OUTPUT"
92+
93+
- name: Check for coding-agent Signed-off-by trailers
94+
id: agent_signoff
95+
run: |
96+
set -euo pipefail
97+
98+
EMAIL_HITS=$(grep -iE "^Signed-off-by:.*<(${AGENT_EMAIL_PATTERN})>" /tmp/pr_commits.txt 2>/dev/null || true)
99+
NAME_HITS=$(grep -iE "^Signed-off-by: *(${AGENT_NAMES}) *[<(]" /tmp/pr_commits.txt 2>/dev/null || true)
100+
101+
AGENT_LINES=$(printf '%s\n%s' "$EMAIL_HITS" "$NAME_HITS" | sort -u | sed '/^[[:space:]]*$/d')
102+
103+
AGENT_SIGNOFF=false
104+
if [ -n "$AGENT_LINES" ]; then
105+
AGENT_SIGNOFF=true
106+
fi
107+
108+
echo "agent_signoff=${AGENT_SIGNOFF}" >> "$GITHUB_OUTPUT"
109+
{
110+
echo "agent_lines<<AGENT_EOF"
111+
echo "${AGENT_LINES}"
112+
echo "AGENT_EOF"
113+
} >> "$GITHUB_OUTPUT"
114+
115+
- name: Check for coding-agent Co-Authored-By trailers
116+
id: co_authored
117+
run: |
118+
set -euo pipefail
119+
120+
EMAIL_HITS=$(grep -iE "^Co-Authored-By:.*<(${AGENT_EMAIL_PATTERN})>" /tmp/pr_commits.txt 2>/dev/null || true)
121+
NAME_HITS=$(grep -iE "^Co-Authored-By: *(${AGENT_NAMES}) *[<(]" /tmp/pr_commits.txt 2>/dev/null || true)
122+
123+
CO_AUTHORED=false
124+
if [ -n "$EMAIL_HITS" ] || [ -n "$NAME_HITS" ]; then
125+
CO_AUTHORED=true
126+
echo "Found coding-agent Co-Authored-By trailer(s):"
127+
printf '%s\n%s' "$EMAIL_HITS" "$NAME_HITS" | sort -u | sed '/^[[:space:]]*$/d'
128+
fi
129+
130+
echo "co_authored=${CO_AUTHORED}" >> "$GITHUB_OUTPUT"
131+
132+
- name: Create 'AI assisted' label if absent
133+
if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
134+
env:
135+
GH_TOKEN: ${{ github.token }}
136+
run: |
137+
gh api "repos/${{ github.repository }}/labels" \
138+
--method POST \
139+
-f name="AI assisted" \
140+
-f color="d93f0b" \
141+
-f description="This PR contains AI-assisted commits" \
142+
2>/dev/null || true
143+
144+
- name: Label PR as AI assisted
145+
if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
146+
env:
147+
GH_TOKEN: ${{ github.token }}
148+
run: |
149+
gh pr edit "${{ github.event.pull_request.number }}" \
150+
--repo "${{ github.repository }}" \
151+
--add-label "AI assisted"
152+
echo "Added 'AI assisted' label to PR #${{ github.event.pull_request.number }}"
153+
154+
- name: Fail on coding-agent Signed-off-by
155+
if: steps.agent_signoff.outputs.agent_signoff == 'true'
156+
env:
157+
AGENT_LINES: ${{ steps.agent_signoff.outputs.agent_lines }}
158+
AGENTS_MD_URL: https://github.com/${{ github.repository }}/blob/${{ github.base_ref }}/AGENTS.md
159+
run: |
160+
echo "::error title=Coding-agent sign-off detected::A Signed-off-by trailer from a known coding agent was found in one or more commits."
161+
echo ""
162+
echo "Offending trailer(s):"
163+
echo "${AGENT_LINES}"
164+
echo ""
165+
echo "The 'Signed-off-by' trailer represents the Developer Certificate of Origin (DCO)"
166+
echo "and must only be attested by a human contributor."
167+
echo "Please amend the affected commit(s) to remove the coding-agent sign-off"
168+
echo "and replace it with an 'Assisted-by' trailer, for example:"
169+
echo ""
170+
echo " Assisted-by: Claude Code:claude-sonnet-4-6"
171+
echo ""
172+
echo "References:"
173+
echo " • AGENTS.md (this repository)"
174+
echo " ${AGENTS_MD_URL}"
175+
echo " • AI Contribution Policy"
176+
echo " https://github.com/nextcloud/.github/blob/master/AI_POLICY.md"
177+
echo " • Contribution Guidelines"
178+
echo " https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md"
179+
exit 1

‎workflow-templates/ai-policy.properties.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"name": "AI Policy",
3+
"description": "Enforce AI contribution policy: detect AI-assistant trailers, block coding-agent DCO sign-offs, and label AI-assisted PRs.",
4+
"iconName": "octicon robot"
5+
}

‎workflow-templates/ai-policy.yml‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
# This workflow is provided via the organization template repository
2+
#
3+
# https://github.com/nextcloud/.github
4+
# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
5+
#
6+
# SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
7+
# SPDX-License-Identifier: MIT
8+
9+
name: AI Policy
10+
11+
on:
12+
pull_request:
13+
types: [opened, synchronize, reopened]
14+
branches: [master, main]
15+
16+
permissions:
17+
contents: read
18+
# Required to add the "AI assisted" label via `gh pr edit --add-label`
19+
pull-requests: write
20+
# Required to create the "AI assisted" label via the REST labels endpoint
21+
# (labels are an issues-scoped resource in the GitHub API)
22+
issues: write
23+
24+
concurrency:
25+
group: ai-policy-${{ github.head_ref || github.run_id }}
26+
cancel-in-progress: true
27+
28+
jobs:
29+
check-ai-trailers:
30+
runs-on: ubuntu-latest
31+
steps:
32+
- name: Checkout
33+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
34+
with:
35+
fetch-depth: 0
36+
persist-credentials: false
37+
38+
- name: Collect PR commit messages
39+
id: collect
40+
env:
41+
BASE_REF: ${{ github.base_ref }}
42+
run: |
43+
set -euo pipefail
44+
git fetch origin "${BASE_REF}"
45+
MERGE_BASE=$(git merge-base "origin/${BASE_REF}" HEAD)
46+
git log --format="%B" "${MERGE_BASE}..HEAD" > /tmp/pr_commits.txt
47+
echo "--- PR commit messages ---"
48+
cat /tmp/pr_commits.txt
49+
echo "--------------------------"
50+
51+
- name: Define shared agent detection patterns
52+
run: |
53+
set -euo pipefail
54+
55+
# Email addresses known to be used by coding agents.
56+
# These should never appear in Signed-off-by because the DCO can only be attested by a human.
57+
EMAIL_PATTERN="copilot@github\.com\
58+
|noreply@anthropic\.com\
59+
|devin@cognition\.ai\
60+
|devin@cognition-labs\.com\
61+
|aider@aider\.chat\
62+
|noreply@aider\.chat\
63+
|codex@openai\.com\
64+
|cursor@anysphere\.com\
65+
|windsurf@codeium\.com\
66+
|codeium@codeium\.com\
67+
|amazon-q@amazon\.com\
68+
|codewhisperer@amazon\.com\
69+
|gemini-code-assist@google\.com\
70+
|openhands@all-hands\.dev\
71+
|swe-agent@princeton\.edu"
72+
73+
# Strip embedded whitespace (used above only for readability)
74+
EMAIL_PATTERN=$(echo "$EMAIL_PATTERN" | tr -d ' \n')
75+
echo "AGENT_EMAIL_PATTERN=${EMAIL_PATTERN}" >> "$GITHUB_ENV"
76+
77+
# Display-name prefixes used by known coding agents (shared by Signed-off-by and Co-Authored-By checks)
78+
# shellcheck disable=SC2016
79+
echo 'AGENT_NAMES=GitHub Copilot|Claude( [A-Za-z0-9. -]+)?|Devin( AI)?|aider( \(.*\))?|OpenAI Codex|Cursor( AI)?|Windsurf|Amazon Q|CodeWhisperer|Gemini Code Assist|OpenHands|SWE-agent|AutoCodeRover|Tabnine' >> "$GITHUB_ENV"
80+
81+
- name: Check for AI-assistant / Assisted-by trailers
82+
id: ai_trailers
83+
run: |
84+
set -euo pipefail
85+
AI_ASSISTED=false
86+
if grep -qiE '^(AI-assistant|Assisted-by):' /tmp/pr_commits.txt; then
87+
AI_ASSISTED=true
88+
echo "Found AI-assistant/Assisted-by trailer(s):"
89+
grep -iE '^(AI-assistant|Assisted-by):' /tmp/pr_commits.txt
90+
fi
91+
echo "ai_assisted=${AI_ASSISTED}" >> "$GITHUB_OUTPUT"
92+
93+
- name: Check for coding-agent Signed-off-by trailers
94+
id: agent_signoff
95+
run: |
96+
set -euo pipefail
97+
98+
EMAIL_HITS=$(grep -iE "^Signed-off-by:.*<(${AGENT_EMAIL_PATTERN})>" /tmp/pr_commits.txt 2>/dev/null || true)
99+
NAME_HITS=$(grep -iE "^Signed-off-by: *(${AGENT_NAMES}) *[<(]" /tmp/pr_commits.txt 2>/dev/null || true)
100+
101+
AGENT_LINES=$(printf '%s\n%s' "$EMAIL_HITS" "$NAME_HITS" | sort -u | sed '/^[[:space:]]*$/d')
102+
103+
AGENT_SIGNOFF=false
104+
if [ -n "$AGENT_LINES" ]; then
105+
AGENT_SIGNOFF=true
106+
fi
107+
108+
echo "agent_signoff=${AGENT_SIGNOFF}" >> "$GITHUB_OUTPUT"
109+
{
110+
echo "agent_lines<<AGENT_EOF"
111+
echo "${AGENT_LINES}"
112+
echo "AGENT_EOF"
113+
} >> "$GITHUB_OUTPUT"
114+
115+
- name: Check for coding-agent Co-Authored-By trailers
116+
id: co_authored
117+
run: |
118+
set -euo pipefail
119+
120+
EMAIL_HITS=$(grep -iE "^Co-Authored-By:.*<(${AGENT_EMAIL_PATTERN})>" /tmp/pr_commits.txt 2>/dev/null || true)
121+
NAME_HITS=$(grep -iE "^Co-Authored-By: *(${AGENT_NAMES}) *[<(]" /tmp/pr_commits.txt 2>/dev/null || true)
122+
123+
CO_AUTHORED=false
124+
if [ -n "$EMAIL_HITS" ] || [ -n "$NAME_HITS" ]; then
125+
CO_AUTHORED=true
126+
echo "Found coding-agent Co-Authored-By trailer(s):"
127+
printf '%s\n%s' "$EMAIL_HITS" "$NAME_HITS" | sort -u | sed '/^[[:space:]]*$/d'
128+
fi
129+
130+
echo "co_authored=${CO_AUTHORED}" >> "$GITHUB_OUTPUT"
131+
132+
- name: Create 'AI assisted' label if absent
133+
if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
134+
env:
135+
GH_TOKEN: ${{ github.token }}
136+
run: |
137+
gh api "repos/${{ github.repository }}/labels" \
138+
--method POST \
139+
-f name="AI assisted" \
140+
-f color="d93f0b" \
141+
-f description="This PR contains AI-assisted commits" \
142+
2>/dev/null || true
143+
144+
- name: Label PR as AI assisted
145+
if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
146+
env:
147+
GH_TOKEN: ${{ github.token }}
148+
run: |
149+
gh pr edit "${{ github.event.pull_request.number }}" \
150+
--repo "${{ github.repository }}" \
151+
--add-label "AI assisted"
152+
echo "Added 'AI assisted' label to PR #${{ github.event.pull_request.number }}"
153+
154+
- name: Fail on coding-agent Signed-off-by
155+
if: steps.agent_signoff.outputs.agent_signoff == 'true'
156+
env:
157+
AGENT_LINES: ${{ steps.agent_signoff.outputs.agent_lines }}
158+
AGENTS_MD_URL: https://github.com/${{ github.repository }}/blob/${{ github.base_ref }}/AGENTS.md
159+
run: |
160+
echo "::error title=Coding-agent sign-off detected::A Signed-off-by trailer from a known coding agent was found in one or more commits."
161+
echo ""
162+
echo "Offending trailer(s):"
163+
echo "${AGENT_LINES}"
164+
echo ""
165+
echo "The 'Signed-off-by' trailer represents the Developer Certificate of Origin (DCO)"
166+
echo "and must only be attested by a human contributor."
167+
echo "Please amend the affected commit(s) to remove the coding-agent sign-off"
168+
echo "and replace it with an 'Assisted-by' trailer, for example:"
169+
echo ""
170+
echo " Assisted-by: Claude Code:claude-sonnet-4-6"
171+
echo ""
172+
echo "References:"
173+
echo " • AGENTS.md (this repository)"
174+
echo " ${AGENTS_MD_URL}"
175+
echo " • AI Contribution Policy"
176+
echo " https://github.com/nextcloud/.github/blob/master/AI_POLICY.md"
177+
echo " • Contribution Guidelines"
178+
echo " https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md"
179+
exit 1

0 commit comments

Comments
 (0)