diff --git a/.github/workflows/seerr-labeller.yml b/.github/workflows/seerr-labeller.yml index 823bb8bd6..e7e8f7b8d 100644 --- a/.github/workflows/seerr-labeller.yml +++ b/.github/workflows/seerr-labeller.yml @@ -39,8 +39,8 @@ jobs: AI-generated code can often introduce subtle bugs, poor design patterns, or inconsistent styles that make long-term maintenance difficult and reduce overall code quality. For the sake of the project's future stability and readability, we require that all contributions meet our established coding standards and demonstrate clear developer oversight. - This pull request is also too large for effective human review. Please discuss with us on how to break down these changes into smaller, more focused PRs to ensure a thorough and efficient review process. - If you'd like to revise and resubmit your changes with careful review and cleanup, we'd be happy to take another look. + Please read our [AI Assistance Notice](https://github.com/seerr-team/seerr/blob/develop/CONTRIBUTING.md#ai-assistance-notice) for what we expect from AI-assisted contributions. + If you'd like to revise and resubmit your changes with genuine review, testing, and an accurate disclosure, we'd be happy to take another look. run: | retry() { n=0; until "$@"; do n=$((n+1)); [ $n -ge 3 ] && break; echo "retry $n: $*" >&2; sleep 2; done; } retry gh pr comment "$NUMBER" -R "$GH_REPO" -b "$BODY" || true diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 609c9d727..b343448d0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -6,53 +6,50 @@ All help is welcome and greatly appreciated! If you would like to contribute to > [!IMPORTANT] > -> Automated AI-generated contributions without human review are not allowed and will be rejected. -> This is an open-source project maintained by volunteers. -> We do not have the resources to review pull requests that could have been avoided with proper human oversight. -> While we have no issue with contributors using AI tools as an aid, it is your responsibility as a contributor to ensure that all submissions are carefully reviewed and meet our quality standards. +> Automated AI-generated contributions without human review are not allowed and will be rejected. This is an open-source project maintained by volunteers. We do not have the resources to review pull requests that could have been avoided with proper human oversight. While we have no issue with contributors using AI tools as an aid, it is your responsibility as a contributor to ensure that all submissions are carefully reviewed and meet our quality standards. > -> **We expect AI-assisted development, not AI-driven development.** -> Use AI as a tool to help you write code. Do not let an AI agent -> autonomously generate an entire contribution and submit it on your behalf. -> We have been increasingly receiving low-effort, fully AI-generated PRs -> and will not tolerate them. Contributors who repeatedly submit unreviewed -> AI output may result in a ban. +> **We expect AI-assisted development, not AI-driven development.** Use AI as a tool to help you write code. Do not let an AI agent autonomously generate an entire contribution and submit it on your behalf. It does not matter who clicks submit, an agent acting on its own or a human relaying its output unread. What matters is whether you reviewed, tested, and understood the change before it went up. We have been increasingly receiving low-effort, fully AI-generated PRs and will not tolerate them. Contributors who repeatedly submit unreviewed AI output may be banned. > -> **Submissions that appear to be unreviewed AI output will be considered low-effort and may result in a ban.** Signs of unreviewed AI output include but are not limited to: +> **Submissions that appear to be unreviewed AI output will be considered low-effort and may result in a ban if repeated even after several warnings.** Signs of unreviewed AI output include but are not limited to: > > - Blank or template-default PR descriptions > - AI-generated PR descriptions that replace our template with their own structure (e.g., "Summary / What changed / Root cause / Test plan" instead of following the PR template; this is the default output format of tools like Claude Code and is an immediate indicator that the PR was not reviewed by a human) +> - AI-generated content moved under our template's headers without being rewritten in your own words. Matching our structure is not the same as writing the description yourself > - Unchecked checklists or missing checklist entirely > - Failing CI checks that would have been caught by running `pnpm build` > - Code that does not match the described changes > - Inability to answer questions about the submitted code > > **Read and follow the [Contributing Guide](CONTRIBUTING.md) before submitting.** -> If your AI tool generates its own PR description format, it is your -> responsibility to rewrite it to follow our template before submitting. -> An incomplete PR template tells maintainers that insufficient review has -> been performed on the submission, regardless of the actual code quality. -> We may close such PRs without review. +> If your AI tool generates its own PR description format, it is your responsibility to rewrite it to follow our template before submitting, and rewrite means write the content yourself, not relabel the AI's output under our section headers. An incomplete PR template tells maintainers that insufficient review has been performed on the submission, regardless of the actual code quality. We may close such PRs without review. > > If you are using **any kind of AI assistance** to contribute to Seerr, it must be disclosed in the pull request. ### Disclosure Requirements -If you are using any kind of AI assistance while contributing to Seerr, -**this must be disclosed in the pull request description**, along with -the extent to which AI assistance was used (e.g., docs only vs. code generation). -If PR responses (comments, review replies) are being generated by AI, -disclose that as well. +If you are using any kind of AI assistance while contributing to Seerr, **this must be disclosed in the pull request description**, along with the extent to which AI assistance was used (e.g., docs only vs. code generation). -As a small exception, trivial tab-completion doesn't need to be disclosed, -so long as it is limited to single keywords or short phrases. +PR responses (comments, review replies) must be written in your own words, per the Expectations below. The one exception is AI-assisted translation, if you use AI to translate a response into English, disclose that here too. -Example disclosures: +As a small exception, trivial tab-completion doesn't need to be disclosed, so long as it is limited to single keywords or short phrases. -> **AI Disclosure:** This PR was written primarily by Claude Code. -> **AI Disclosure:** I consulted ChatGPT to understand the codebase but the solution +**Disclosure does not exempt a PR from the AI-driven development policy above.** +If the implementation was primarily generated by an AI tool in one or two prompts, and your own involvement was limited to testing or a small edit, that is AI-driven development whether or not you disclosed it. Disclosure tells us how much scrutiny to apply to your PR. It does not turn an AI-driven contribution into an AI-assisted one. + +Example disclosures that meet our bar: + +> - **AI Disclosure:** I designed the approach and wrote the implementation myself. +> I used Claude to scaffold the initial component and help debug a TypeScript +> generics issue. +> - **AI Disclosure:** I consulted ChatGPT to understand the codebase but the solution > was fully authored manually by myself. -> **AI Disclosure:** None. +> - **AI Disclosure:** None. + +A disclosure like the one below is honest, but the PR will still be closed as +AI-driven: + +> **AI Disclosure:** This PR was written primarily by Claude Code, then tested +> and lightly tweaked. When using AI assistance, we expect contributors to: @@ -62,51 +59,29 @@ When using AI assistance, we expect contributors to: filling out the PR template, testing section, and checklist. - **Run the build and tests** before submitting. -Failure to disclose AI assistance is first and foremost disrespectful to the -human maintainers on the other end of the pull request, but it also makes it -difficult to determine how much scrutiny to apply to the contribution. +Failure to disclose AI assistance is first and foremost disrespectful to the human maintainers on the other end of the pull request, but it also makes it difficult to determine how much scrutiny to apply to the contribution. -In a perfect world, AI assistance would produce equal or higher quality -work than any human. That is not the world we live in today, and in most cases -it is generating slop. +In a perfect world, AI assistance would produce equal or higher quality work than any human. That is not the world we live in today, and in most cases it is generating slop. -When using AI assistance, we expect contributors to understand the code -that is produced and be able to answer critical questions about it. It -is not a maintainer's job to review a PR so broken that it requires -significant rework to be acceptable. +When using AI assistance, we expect contributors to understand the code that is produced and be able to answer critical questions about it. It is not a maintainer's job to review a PR so broken that it requires significant rework to be acceptable. Please be respectful to maintainers and disclose AI assistance. ### Expectations for AI-Assisted Contributions -1. **PR descriptions and all comments must be your own words.** Do not paste - LLM output as your PR description, review response, or issue comment. - We want *your* understanding and explanation of the changes, not a - machine-generated summary. An exception is made for LLM-assisted - translation, however, note it explicitly if used. +1. **PR descriptions and all comments must be your own words.** Do not paste LLM output as your PR description, review response, or issue comment. We want *your* understanding and explanation of the changes, not a machine-generated summary. An exception is made for LLM-assisted translation, however, note it explicitly if used. -2. **Contributions must be concise and focused.** A PR that claims to fix one thing - but touches a bunch of unrelated code will be rejected. This is a - common side effect of broad AI prompts and makes review unnecessarily - difficult. + **Don't be a meat proxy** (the term is borrowed from [this post](https://gruhn.me/blog/2026-08-03/)). If a maintainer asks you a question and you paste it into an AI, then paste the answer back without reading it, checking it against the code, and putting it in your own words, you haven't added anything to the exchange. We could have asked the AI ourselves and skipped the wait. This project is maintained by volunteers reviewing your contribution on their own time, and relaying answers you haven't read wastes that time rather than saving it. -3. **You must be able to handle review feedback yourself.** If you cannot discuss or - implement requested changes without round-tripping reviewer comments - through an AI, that tells us you don't understand the code you - submitted. We will close the PR. +2. **Contributions must be concise and focused.** A PR that claims to fix one thing but touches a bunch of unrelated code will be rejected. This is a common side effect of broad AI prompts and makes review unnecessarily difficult. -4. **Don't commit non-project files.** Editor configs, AI tool - directories, and other local tooling files do not belong in the - repository. Keep your commits clean. +3. **You must be able to handle review feedback yourself.** If you cannot discuss or implement requested changes without round-tripping reviewer comments through an AI, that tells us you don't understand the code you submitted. We will close the PR. -5. **Changes must be tested.** Build the project, run the tests, and - manually verify the functionality you modified. Don't just assume - CI will catch everything. +4. **Don't commit non-project files.** Editor configs, AI tool directories, and other local tooling files do not belong in the repository. Keep your commits clean. -6. **Final discretion lies with the reviewers.** If a PR cannot be - reasonably reviewed for any reason due to over-complexity, size, or poor - structure, it will be rejected. This applies equally to AI-assisted - and non-AI-assisted contributions. +5. **Changes must be tested.** Build the project, run the tests, and manually verify the functionality you modified. Don't just assume CI will catch everything. + +6. **Final discretion lies with the reviewers.** If a PR cannot be reasonably reviewed for any reason due to over-complexity, size, or poor structure, it will be rejected. This applies equally to AI-assisted and non-AI-assisted contributions. ## Development diff --git a/SECURITY.md b/SECURITY.md index 5f20209c3..b0a6eb00c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,44 +12,35 @@ To report a security issue, please use the GitHub Security Advisory ["Report a V > [!IMPORTANT] > -> Automated AI-generated contributions without human review are not allowed and will be rejected. -> This is an open-source project maintained by volunteers. -> We do not have the resources to review pull requests that could have been avoided with proper human oversight. -> While we have no issue with contributors using AI tools as an aid, it is your responsibility as a contributor to ensure that all submissions are carefully reviewed and meet our quality standards. -> Submissions that appear to be unreviewed AI output will be considered low-effort and may result in a ban. +> Automated AI-generated reports without human review are not allowed and will be rejected. This is an open-source project maintained by volunteers. We do not have the resources to review reports that could have been avoided with proper human oversight. > -> If you are using **any kind of AI assistance** to contribute to Seerr, -> it must be disclosed in the pull request. +> While we have no issue with reporters using AI tools as an aid, it is your responsibility as a reporter to ensure that all reports are carefully reviewed and meet our quality standards. Contributors who repeatedly submit unreviewed, low-effort AI output may be banned. +> +> We expect AI-assisted work, not AI-driven work. Use AI as a tool, not as a stand-in for your own review. It does not matter who submits it. Whether it's an agent acting on its own or a human relaying its output unread. What matters is whether you reviewed, verified, and understood your report or response before you sent it. +> +> If you are using **any kind of AI assistance** for a security report or response, it must be disclosed in your report. -If you are using any kind of AI assistance while contributing to Seerr, -**this must be disclosed in the pull request**, along with the extent to -which AI assistance was used (e.g. docs only vs. code generation). -If security advisory responses are being generated by an AI, disclose that as well. -As a small exception, trivial tab-completion doesn't need to be disclosed, -so long as it is limited to single keywords or short phrases. +If you are using any kind of AI assistance for a security report or response, this must be disclosed, along with the extent to which AI assistance was used (e.g. used to help investigate the issue vs. used to write the report itself). -An example disclosure: +Security advisory responses must be written in your own words, same as described below for the meat proxy problem. The one exception is AI-assisted translation, if you use AI to translate a response into English, disclose that here too. As a small exception, trivial tab-completion doesn't need to be disclosed, so long as it is limited to single keywords or short phrases. + +**Disclosure does not exempt a report or response from this policy.** If a security report or advisory response was primarily generated by an AI tool with little more than a copy and paste on your end, that is still AI-driven, whether or not you disclosed it. + +A more detailed disclosure that meets our bar: + +> I consulted ChatGPT to understand the codebase but the solution was fully authored manually by myself. + +A disclosure like the one below is honest, but the response will still be treated as AI-driven: > This security advisory was written primarily by Claude Code. -Or a more detailed disclosure: +Failure to disclose this is first and foremost rude to the human operators on the other end of the report, but it also makes it difficult to determine how much scrutiny to apply to the submission. -> I consulted ChatGPT to understand the codebase but the solution -> was fully authored manually by myself. +Don't be a meat proxy between an AI and the security team either (the term is borrowed from [this post](https://gruhn.me/blog/2026-08-03/)). If we ask a follow-up question about your report and you relay it to an AI, then paste back an answer you haven't read or checked against the actual code, you haven't added anything, we could have asked the AI ourselves. We are volunteers handling this on our own time. Read the response, verify it, and write your own answer. -Failure to disclose this is first and foremost rude to the human operators -on the other end of the pull request, but it also makes it difficult to -determine how much scrutiny to apply to the contribution. +In a perfect world, AI assistance would produce equal or higher quality work than any human. That isn't the world we live in today, and in most cases it's generating slop. I say this despite being a fan of and using them successfully myself (with heavy supervision)! -In a perfect world, AI assistance would produce equal or higher quality -work than any human. That isn't the world we live in today, and in most cases -it's generating slop. I say this despite being a fan of and using them -successfully myself (with heavy supervision)! - -When using AI assistance, we expect contributors to understand the code -that is produced and be able to answer critical questions about it. It -isn't a maintainers job to review a PR so broken that it requires -significant rework to be acceptable. +When using AI assistance, we expect reporters to understand the findings they're submitting and be able to answer critical questions about them. It isn't a maintainer's job to review a report so broken that it requires significant rework to be acceptable. Please be respectful to maintainers and disclose AI assistance.