diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 6880a6df5e3c01..6903a42d346364 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -7,9 +7,15 @@ Also, please make sure you do the following: - Read the Contributing Guidelines at https://github.com/vitejs/vite/blob/main/CONTRIBUTING.md. -- Check that there isn't already a PR that solves the problem the same way. If you find a duplicate, please help us review it. +- Check that there isn't already a PR that solves the problem the same way. If you find a duplicate, please help us review it. If you've solved it in a different way, clarify what is different and link the other PRs in the PR description. - Update the corresponding documentation if needed. - Include relevant tests that fail without this PR but pass with it. If the tests are not included, explain why. +If you have used AI: + +- Read the AI Policy at https://github.com/vitejs/vite/blob/main/CONTRIBUTING.md#ai-policy. +- Keep the PR description and discussion concise. Use your own words, do not let AI write for you. +- Disclose and describe how you have reviewed its code, e.g. the thought process and decisions that lead to the final code. + Thank you for contributing to Vite! --> diff --git a/.github/actions/issues-helper/action.yml b/.github/actions/issues-helper/action.yml index f2aeb0937f2cc9..56f141ce5d5cbf 100644 --- a/.github/actions/issues-helper/action.yml +++ b/.github/actions/issues-helper/action.yml @@ -3,13 +3,13 @@ description: Add labels, create comments, close stale issues, or lock inactive c inputs: actions: required: true - description: One of `add-labels`, `remove-labels`, `create-comment`, `close-issues`, `lock-closed-issues`. + description: One of `add-labels`, `remove-labels`, `create-comment`, `close-issue`, `close-issues`, `lock-closed-issues`. token: required: true description: GitHub token. issue-number: required: false - description: Issue or PR number. Required for `add-labels`, `remove-labels` and `create-comment`. + description: Issue or PR number. Required for `add-labels`, `remove-labels`, `create-comment`, and `close-issue`. labels: required: false description: Comma-separated label names. Required for `add-labels`, `remove-labels` and `close-issues`. @@ -79,6 +79,21 @@ runs: body: process.env.INPUT_BODY, }) + - name: Close issue + if: inputs.actions == 'close-issue' + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 + env: + INPUT_ISSUE_NUMBER: ${{ inputs.issue-number }} + with: + github-token: ${{ inputs.token }} + script: | + await github.rest.issues.update({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: Number(process.env.INPUT_ISSUE_NUMBER), + state: 'closed', + }) + - name: Close stale issues if: inputs.actions == 'close-issues' uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml new file mode 100644 index 00000000000000..e7ca420329e984 --- /dev/null +++ b/.github/workflows/bot.yml @@ -0,0 +1,146 @@ +name: Bot + +on: + issues: + types: [labeled] + # zizmor: ignore[dangerous-triggers] + # SAFETY: pull_request_target is used here because: + # - The workflow does NOT check out PR code + # - No PR-supplied code is executed + # - We trust MatteoGabriele/agentscan-action to handle the permissions appriopriately + pull_request_target: + types: [opened, reopened, labeled] + +# Supported labels: +# - `bot: skip` - Added manually before re-opening a PR if it's legit to skip AgentScan. +# - `bot: maybe` - Added by AgentScan. Indication only. +# - `bot: likely` - Added by AgentScan or manually. Indicates that the issue or PR is likely to be +# created by a bot, LLM, or agent. Will comment and close automatically. + +jobs: + agentscan: + if: > + github.event_name == 'pull_request_target' && + (github.event.action == 'opened' || github.event.action == 'reopened') && + !contains(github.event.pull_request.labels.*.name, 'bot: skip') + name: AgentScan + runs-on: ubuntu-slim + permissions: + pull-requests: write + contents: read + steps: + - name: Cache AgentScan analysis + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 + with: + path: .agentscan-cache + key: agentscan-cache-${{ github.event.pull_request.user.login }} + restore-keys: agentscan-cache- + + - name: AgentScan + id: agentscan + uses: MatteoGabriele/agentscan-action@98202262c925c508d4c1424b1dfbe17ee35b0c02 # v2.4.0 + with: + mode: labels + cache-path: .agentscan-cache + trusted-author-associations: "member,owner,collaborator" + label-mixed: "bot: maybe" + label-automation: "bot: likely" + label-community-flagged: "bot: likely" + + - name: Comment + if: steps.agentscan.outputs.classification == 'automation' || steps.agentscan.outputs.community-flagged == 'true' + uses: $/.github/actions/issues-helper + with: + actions: "create-comment" + token: ${{ secrets.GITHUB_TOKEN }} + issue-number: ${{ github.event.pull_request.number }} + body: >- + + + This PR has been [automatically flagged](https://agentscan.tools/user/${{ github.event.pull_request.user.login }}) as likely to be created by a bot, LLM, or agent, + and will be automatically closed. These contributions harm the maintenance of the project. + Please read our [AI policy](https://github.com/vitejs/vite/blob/main/CONTRIBUTING.md#ai-policy) + for more information. + + If you believe this is a mistake, please reply to this comment and we will review it. + + - name: Close + if: steps.agentscan.outputs.classification == 'automation' || steps.agentscan.outputs.community-flagged == 'true' + uses: $/.github/actions/issues-helper + with: + actions: "close-issue" + token: ${{ secrets.GITHUB_TOKEN }} + issue-number: ${{ github.event.pull_request.number }} + + issue: + if: > + github.event_name == 'issues' && + github.event.label.name == 'bot: likely' + name: Comment and close issue + runs-on: ubuntu-slim + permissions: + issues: write + steps: + - name: Comment + uses: $/.github/actions/issues-helper + with: + actions: "create-comment" + token: ${{ secrets.GITHUB_TOKEN }} + issue-number: ${{ github.event.issue.number }} + body: >- + + + The issue has been manually labeled as likely to be created by a bot, LLM, or agent, + and will be automatically closed. This may be because the issue is overly verbose or + does not contain any fruitful interaction, which harms the triaging process. + Please read our [AI policy](https://github.com/vitejs/vite/blob/main/CONTRIBUTING.md#ai-policy) + for more information. + + If you believe this is a mistake, please reply to this comment and we will review it. + + - name: Close + uses: $/.github/actions/issues-helper + with: + actions: "close-issue" + token: ${{ secrets.GITHUB_TOKEN }} + issue-number: ${{ github.event.issue.number }} + + pr: + name: Comment and close PR + runs-on: ubuntu-slim + if: > + github.event_name == 'pull_request_target' && + github.event.label.name == 'bot: likely' + permissions: + pull-requests: write + steps: + - name: Comment + uses: $/.github/actions/issues-helper + with: + actions: "create-comment" + token: ${{ secrets.GITHUB_TOKEN }} + issue-number: ${{ github.event.pull_request.number }} + body: >- + + + The PR has been manually labeled as likely to be created by a bot, LLM, or agent, + and will be automatically closed. This may be because the PR contains LLM-generated + descriptions, does not follow the PR template, is overly verbose, or does not contain + any fruitful interaction, which harms the review process. + Please read our [AI policy](https://github.com/vitejs/vite/blob/main/CONTRIBUTING.md#ai-policy) + for more information. + + If you believe this is a mistake, please reply to this comment and we will review it. + + - name: Close + uses: $/.github/actions/issues-helper + with: + actions: "close-issue" + token: ${{ secrets.GITHUB_TOKEN }} + issue-number: ${{ github.event.pull_request.number }} diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 59ceee7771a153..49053ab48a4952 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -221,6 +221,17 @@ In many test cases, we need to mock dependencies using `link:` and `file:` proto For a mock dependency, make sure you add a `@vitejs/test-` prefix to the package name. This will avoid possible issues like false-positive alerts. +## AI Policy + + + +We welcome the thoughtful use of AI tools when contributing to Vite, but ask all contributors to follow [two core principles](https://roe.dev/blog/using-ai-in-open-source): + +1. **Never let an LLM speak for you** - all comments, issues, and PR descriptions should be written in your own words, reflecting your own understanding. +2. **Never let an LLM think for you** - only submit contributions you fully understand and can explain. + +If we find that these principles were not followed, we may close the issue or pull request directly. + ## Pull Request Guidelines > [!NOTE]