Skip to content

Commit 4e0888c

Browse files
AndyScherzingerAndyScherzinger
authored
Merge pull request #304 from nextcloud/ci/noid/ai-policy
Add AI policy check
2 parents 51a9ed2 + a12fdee commit 4e0888c

1 file changed

Lines changed: 172 additions & 0 deletions

File tree

‎.github/workflows/ai-policy.yml‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
# This workflow is provided via the organization template repository
2+
#
3+
# https://github.com/nextcloud/.github
4+
# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
5+
#
6+
# SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
7+
# SPDX-License-Identifier: MIT
8+
9+
name: AI Policy
10+
11+
on:
12+
pull_request:
13+
types: [opened, synchronize, reopened]
14+
branches: [master, main]
15+
16+
permissions:
17+
contents: read
18+
# Required to add the "AI assisted" label via `gh pr edit --add-label`
19+
pull-requests: write
20+
# Required to create the "AI assisted" label via the REST labels endpoint
21+
# (labels are an issues-scoped resource in the GitHub API)
22+
issues: write
23+
24+
concurrency:
25+
group: ai-policy-${{ github.head_ref || github.run_id }}
26+
cancel-in-progress: true
27+
28+
jobs:
29+
check-ai-trailers:
30+
runs-on: ubuntu-latest-low
31+
steps:
32+
- name: Collect PR commit messages
33+
id: collect
34+
env:
35+
GH_TOKEN: ${{ github.token }}
36+
COMMITS_URL: ${{ github.event.pull_request.commits_url }}
37+
run: |
38+
set -euo pipefail
39+
gh api ${COMMITS_URL} | jq -r '.[] | .commit.message' > /tmp/pr_commits.txt
40+
echo "--- PR commit messages ---"
41+
cat /tmp/pr_commits.txt
42+
echo "--------------------------"
43+
44+
- name: Define shared agent detection patterns
45+
run: |
46+
set -euo pipefail
47+
48+
# Email addresses known to be used by coding agents.
49+
# These should never appear in Signed-off-by because the DCO can only be attested by a human.
50+
EMAIL_PATTERN="copilot@github\.com\
51+
|noreply@anthropic\.com\
52+
|devin@cognition\.ai\
53+
|devin@cognition-labs\.com\
54+
|aider@aider\.chat\
55+
|noreply@aider\.chat\
56+
|codex@openai\.com\
57+
|cursor@anysphere\.com\
58+
|windsurf@codeium\.com\
59+
|codeium@codeium\.com\
60+
|amazon-q@amazon\.com\
61+
|codewhisperer@amazon\.com\
62+
|gemini-code-assist@google\.com\
63+
|openhands@all-hands\.dev\
64+
|swe-agent@princeton\.edu"
65+
66+
# Strip embedded whitespace (used above only for readability)
67+
EMAIL_PATTERN=$(echo "$EMAIL_PATTERN" | tr -d ' \n')
68+
echo "AGENT_EMAIL_PATTERN=${EMAIL_PATTERN}" >> "$GITHUB_ENV"
69+
70+
# Display-name prefixes used by known coding agents (shared by Signed-off-by and Co-Authored-By checks)
71+
# shellcheck disable=SC2016
72+
echo 'AGENT_NAMES=GitHub Copilot|Claude( [A-Za-z0-9. -]+)?|Devin( AI)?|aider( \(.*\))?|OpenAI Codex|Cursor( AI)?|Windsurf|Amazon Q|CodeWhisperer|Gemini Code Assist|OpenHands|SWE-agent|AutoCodeRover|Tabnine' >> "$GITHUB_ENV"
73+
74+
- name: Check for AI-assistant / Assisted-by trailers
75+
id: ai_trailers
76+
run: |
77+
set -euo pipefail
78+
AI_ASSISTED=false
79+
if grep -qiE '^(AI-assistant|Assisted-by|AI-Assisted-By):' /tmp/pr_commits.txt; then
80+
AI_ASSISTED=true
81+
echo "Found AI-assistant/Assisted-by/AI-Assisted-By trailer(s):"
82+
grep -iE '^(AI-assistant|Assisted-by|AI-Assisted-By):' /tmp/pr_commits.txt
83+
fi
84+
echo "ai_assisted=${AI_ASSISTED}" >> "$GITHUB_OUTPUT"
85+
86+
- name: Check for coding-agent Signed-off-by trailers
87+
id: agent_signoff
88+
run: |
89+
set -euo pipefail
90+
91+
EMAIL_HITS=$(grep -iE "^Signed-off-by:.*<(${AGENT_EMAIL_PATTERN})>" /tmp/pr_commits.txt 2>/dev/null || true)
92+
NAME_HITS=$(grep -iE "^Signed-off-by: *(${AGENT_NAMES}) *[<(]" /tmp/pr_commits.txt 2>/dev/null || true)
93+
94+
AGENT_LINES=$(printf '%s\n%s' "$EMAIL_HITS" "$NAME_HITS" | sort -u | sed '/^[[:space:]]*$/d')
95+
96+
AGENT_SIGNOFF=false
97+
if [ -n "$AGENT_LINES" ]; then
98+
AGENT_SIGNOFF=true
99+
fi
100+
101+
echo "agent_signoff=${AGENT_SIGNOFF}" >> "$GITHUB_OUTPUT"
102+
{
103+
echo "agent_lines<<AGENT_EOF"
104+
echo "${AGENT_LINES}"
105+
echo "AGENT_EOF"
106+
} >> "$GITHUB_OUTPUT"
107+
108+
- name: Check for coding-agent Co-Authored-By trailers
109+
id: co_authored
110+
run: |
111+
set -euo pipefail
112+
113+
EMAIL_HITS=$(grep -iE "^Co-Authored-By:.*<(${AGENT_EMAIL_PATTERN})>" /tmp/pr_commits.txt 2>/dev/null || true)
114+
NAME_HITS=$(grep -iE "^Co-Authored-By: *(${AGENT_NAMES}) *[<(]" /tmp/pr_commits.txt 2>/dev/null || true)
115+
116+
CO_AUTHORED=false
117+
if [ -n "$EMAIL_HITS" ] || [ -n "$NAME_HITS" ]; then
118+
CO_AUTHORED=true
119+
echo "Found coding-agent Co-Authored-By trailer(s):"
120+
printf '%s\n%s' "$EMAIL_HITS" "$NAME_HITS" | sort -u | sed '/^[[:space:]]*$/d'
121+
fi
122+
123+
echo "co_authored=${CO_AUTHORED}" >> "$GITHUB_OUTPUT"
124+
125+
- name: Create 'AI assisted' label if absent
126+
if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
127+
env:
128+
GH_TOKEN: ${{ github.token }}
129+
run: |
130+
gh api "repos/${{ github.repository }}/labels" \
131+
--method POST \
132+
-f name="AI assisted" \
133+
-f color="d93f0b" \
134+
-f description="This PR contains AI-assisted commits" \
135+
2>/dev/null || true
136+
137+
- name: Label PR as AI assisted
138+
if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
139+
env:
140+
GH_TOKEN: ${{ github.token }}
141+
run: |
142+
gh pr edit "${{ github.event.pull_request.number }}" \
143+
--repo "${{ github.repository }}" \
144+
--add-label "AI assisted"
145+
echo "Added 'AI assisted' label to PR #${{ github.event.pull_request.number }}"
146+
147+
- name: Fail on coding-agent Signed-off-by
148+
if: steps.agent_signoff.outputs.agent_signoff == 'true'
149+
env:
150+
AGENT_LINES: ${{ steps.agent_signoff.outputs.agent_lines }}
151+
AGENTS_MD_URL: https://github.com/${{ github.repository }}/blob/${{ github.base_ref }}/AGENTS.md
152+
run: |
153+
echo "::error title=Coding-agent sign-off detected::A Signed-off-by trailer from a known coding agent was found in one or more commits."
154+
echo ""
155+
echo "Offending trailer(s):"
156+
echo "${AGENT_LINES}"
157+
echo ""
158+
echo "The 'Signed-off-by' trailer represents the Developer Certificate of Origin (DCO)"
159+
echo "and must only be attested by a human contributor."
160+
echo "Please amend the affected commit(s) to remove the coding-agent sign-off"
161+
echo "and replace it with an 'Assisted-by' trailer, for example:"
162+
echo ""
163+
echo " Assisted-by: Claude Code:claude-sonnet-4-6"
164+
echo ""
165+
echo "References:"
166+
echo " • AGENTS.md (this repository)"
167+
echo " ${AGENTS_MD_URL}"
168+
echo " • AI Contribution Policy"
169+
echo " https://github.com/nextcloud/.github/blob/master/AI_POLICY.md"
170+
echo " • Contribution Guidelines"
171+
echo " https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md"
172+
exit 1

0 commit comments

Comments
 (0)