Thanks for helping build a healthier interface between AI agents and open source maintainers.
- Search existing issues and pull requests.
- For a substantial feature, policy change, new provider, or architecture change, open a design issue first.
- Security vulnerabilities must be reported privately through GitHub Security Advisories.
- Read AGENTS.md, GOVERNANCE.md, and docs/THREAT_MODEL.md.
AI assistance is welcome; unaccountable output is not. The person opening the pull request must:
- disclose meaningful AI assistance;
- understand and review every submitted change;
- verify that generated material is compatible with the project license;
- run the relevant checks;
- respond to reviewer questions without delegating identity or legal attestations to an agent.
Do not paste secrets, private source code, vulnerability details, or third-party personal data into an external model without authorization.
git clone https://github.com/tang-vu/ContribAI.git
cd ContribAI
rustup component add rustfmt clippy
cargo build --workspace
cargo test --workspaceRust under crates/contribai-rs/ is the maintained implementation. Python under python/ is
legacy reference code; changes there should be limited to critical security or archival fixes.
- Create a focused branch from
main. - Keep the change small and explain its user or maintainer value.
- Add tests for behavior and guardrail changes.
- Update public documentation and examples when behavior changes.
- Run the required verification.
- Open a pull request using the repository template.
Use conventional commit prefixes: feat, fix, refactor, docs, test, perf, security,
or chore.
cargo fmt --all -- --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
cargo build --workspace --releaseAdditional expectations by change type:
| Area | Required evidence |
|---|---|
| Admission or permissions | allow and deny tests; fail-closed behavior |
| GitHub writes | idempotency/retry analysis; mocked request assertion |
| CLI capability | default-off parser test and help text |
| Configuration | deserialize the shipped example/template |
| Web/API | authentication and non-loopback exposure tests |
| Workflow/release | least privilege, immutable action pins, reproducibility notes |
| Documentation | commands, links, versions, and claims checked against code |
- Authorization is deterministic policy code, never an LLM decision.
- Reading and generating do not imply permission to publish.
- Missing consent, evidence, identity, base revision, or validation is a denial.
- Generated proposals cannot change governance, workflow, consent, funding, security-policy, or agent-instruction files.
- A change that increases maintainer review burden needs a stronger justification than one that reduces it.
- Do not add vanity metrics that reward issue/PR volume. Prefer acceptance rate, review burden, false-positive rate, time-to-decision, and policy-denial telemetry.
Maintainers may request changes or close proposals that are technically correct but poorly scoped, uninvited, hard to verify, or inconsistent with the product contract. A maintainer other than the author should approve security-sensitive or governance changes whenever practical.
The project uses squash merge unless preserving individual commits materially improves the history. Release notes should describe user-visible behavior and migrations rather than internal activity.
ContribAI does not require an automated CLA. By contributing, you represent that you have the right to submit the work under the project license. DCO sign-off may be used where repository rules require it, but no bot or agent may make that attestation on a person's behalf.