Skip to content

Commit fc9c75e

Browse files
committed
feat: add maintainer-governed contribution admission
1 parent e5acf4a commit fc9c75e

69 files changed

Lines changed: 7959 additions & 3155 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/ISSUE_TEMPLATE/bug-report.yml

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,17 @@ body:
4242
placeholder: "0.1.0"
4343

4444
- type: input
45-
id: python
45+
id: rust
4646
attributes:
47-
label: Python Version
48-
placeholder: "3.12.1"
47+
label: Rust Version
48+
description: Output of `rustc --version`
49+
placeholder: "rustc 1.x.y"
50+
51+
- type: textarea
52+
id: safety
53+
attributes:
54+
label: Safety impact
55+
description: Did this cause or risk an unintended GitHub write, credential leak, consent bypass, or public exposure?
4956

5057
- type: dropdown
5158
id: os

.github/ISSUE_TEMPLATE/config.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Private security report
4+
url: https://github.com/tang-vu/ContribAI/security/advisories/new
5+
about: Report vulnerabilities privately; do not open a public issue.
6+
- name: Design discussion
7+
url: https://github.com/tang-vu/ContribAI/discussions
8+
about: Discuss broad product direction before proposing a large change.

.github/ISSUE_TEMPLATE/feature-request.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,17 @@ body:
4242
- CLI Interface
4343
- Discovery
4444
- PR Manager
45+
- Admission / Consent
46+
- Evidence / Policy
47+
- Security / Supply Chain
4548
- Memory/Storage
4649
- Documentation
4750
- Other
51+
52+
- type: textarea
53+
id: externalities
54+
attributes:
55+
label: Maintainer impact and abuse resistance
56+
description: How does this affect upstream review burden, permissions, consent, or misuse risk?
57+
validations:
58+
required: true
Lines changed: 9 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,18 @@
1-
name: 🔒 Security Report
2-
description: Report a security vulnerability (please use responsibly)
1+
name: Security guidance
2+
description: Do not disclose vulnerabilities in a public issue
33
labels: ["type/security"]
44
body:
55
- type: markdown
66
attributes:
77
value: |
8-
⚠️ **For critical vulnerabilities**, please email security@contribai.dev instead of filing a public issue.
8+
Do **not** publish vulnerability details here.
99
10-
- type: textarea
11-
id: description
12-
attributes:
13-
label: Vulnerability Description
14-
description: Describe the security issue
15-
validations:
16-
required: true
10+
Please use [GitHub private vulnerability reporting](../../security/advisories/new). Include the affected version, impact, prerequisites, and minimal reproduction steps. See [SECURITY.md](../../SECURITY.md) for the full policy.
1711
18-
- type: dropdown
19-
id: severity
12+
- type: checkboxes
13+
id: confirmation
2014
attributes:
21-
label: Estimated Severity
15+
label: Confirmation
2216
options:
23-
- Critical
24-
- High
25-
- Medium
26-
- Low
27-
28-
- type: textarea
29-
id: impact
30-
attributes:
31-
label: Potential Impact
32-
description: What could an attacker achieve?
33-
34-
- type: textarea
35-
id: reproduction
36-
attributes:
37-
label: Steps to Reproduce
38-
description: How can this be reproduced?
17+
- label: I will use private vulnerability reporting instead of this public form.
18+
required: true

.github/copilot-instructions.md

Lines changed: 10 additions & 147 deletions
Original file line numberDiff line numberDiff line change
@@ -1,153 +1,16 @@
1-
# AI Agent Guide for ContribAI
1+
# Copilot instructions
22

3-
> This document is designed for AI assistants (GitHub Copilot, Claude, Cursor, Coderabbit, etc.)
4-
> scanning this repository. It provides structured context to help AI understand the codebase.
3+
Read and follow [`AGENTS.md`](../AGENTS.md) before changing this repository.
54

6-
## What This Project Is
5+
The maintained implementation is Rust in `crates/contribai-rs`; `python/` is legacy reference
6+
code. Preserve ContribAI's core invariant: analysis is the default, and every external write needs
7+
explicit operator intent, repository consent, scoped admission, evidence, and human review. Never
8+
add a CLA-signing flow or a publication bypass.
79

8-
ContribAI is an **autonomous AI agent** that contributes to open source projects on GitHub.
9-
It discovers repos, analyzes code, generates fixes, and submits pull requests — all without human intervention.
10-
11-
**It is NOT** a library/SDK, web app, or CLI tool intended for end-user consumption.
12-
It is itself an AI agent that operates on other GitHub repositories.
13-
14-
## Tech Stack
15-
16-
| Layer | Technology |
17-
|-------|-----------|
18-
| Language | Python 3.11+ |
19-
| Async | asyncio, aiohttp |
20-
| HTTP | httpx (async) |
21-
| Database | SQLite (aiosqlite) |
22-
| LLM | Google Gemini (primary), OpenAI, Anthropic, Ollama, Vertex AI |
23-
| GitHub | REST API v3 (via httpx) |
24-
| Web | FastAPI + uvicorn |
25-
| CLI | Typer + Rich |
26-
| Tests | pytest (333 tests) |
27-
| Lint | ruff |
28-
29-
## Architecture (v2.4.1)
30-
31-
### Core Pipeline
32-
```
33-
Discovery → Middleware Chain → Analysis → Generation → PR → CI Monitor
34-
```
35-
36-
### Key Patterns
37-
1. **Middleware Chain** — 5 ordered middlewares (`contribai/core/middleware.py`)
38-
2. **Progressive Skills** — 17 analysis skills loaded on-demand (`contribai/analysis/skills.py`)
39-
3. **Sub-Agent Registry** — 4 agents with parallel execution (`contribai/agents/registry.py`)
40-
4. **Tool Protocol** — MCP-inspired tool interface (`contribai/tools/protocol.py`)
41-
5. **Outcome Learning** — Tracks PR outcomes to learn per-repo preferences (`contribai/orchestrator/memory.py`)
42-
6. **Context Summarization** — Compresses analysis results for LLM context (`contribai/analysis/analyzer.py`)
43-
44-
### Module Dependency Graph
45-
```
46-
cli/main.py
47-
└── orchestrator/pipeline.py (entry point)
48-
├── core/config.py (configuration)
49-
├── core/middleware.py (pipeline middlewares)
50-
├── github/client.py (HTTP API)
51-
├── github/discovery.py (repo search)
52-
├── analysis/analyzer.py (7 analyzers)
53-
│ └── analysis/skills.py (progressive loading)
54-
├── generator/engine.py (code generation)
55-
│ └── generator/scorer.py (quality scoring)
56-
├── pr/manager.py (PR lifecycle)
57-
├── pr/patrol.py (review monitoring)
58-
├── issues/solver.py (issue solving)
59-
├── orchestrator/memory.py (SQLite persistence)
60-
├── agents/registry.py (sub-agent orchestration)
61-
└── tools/protocol.py (tool interface)
62-
```
63-
64-
## Code Conventions
65-
66-
| Convention | Standard |
67-
|-----------|---------|
68-
| Naming | `snake_case` for functions/variables, `PascalCase` for classes |
69-
| Docstrings | Google style with Args/Returns/Raises |
70-
| Async | All I/O operations are `async/await` |
71-
| Error handling | `try/except` with logging, no bare `except` |
72-
| Imports | Absolute imports, `from __future__ import annotations` |
73-
| Type hints | Full type hints, `str | None` style unions |
74-
| Line length | 100 chars (ruff) |
75-
| Formatting | ruff format |
76-
77-
## Common Patterns
78-
79-
### LLM Calls
80-
```python
81-
# All LLM calls go through LLMProvider.complete()
82-
response = await self._llm.complete(prompt, system_prompt=system)
83-
```
84-
85-
### GitHub API Calls
86-
```python
87-
# All GitHub API calls go through GitHubClient
88-
content = await self._github.get_file_content(owner, repo, path)
89-
await self._github.create_or_update_file(owner, repo, path, content, message, signoff=signoff)
90-
```
91-
92-
### Configuration
93-
```python
94-
# All config through Pydantic-like dataclasses in core/config.py
95-
config = ContribAIConfig.from_yaml("config.yaml")
96-
config.github.token # str
97-
config.llm.provider # str
98-
config.analysis.enabled_analyzers # list[str]
99-
```
100-
101-
### Memory/Persistence
102-
```python
103-
# SQLite via aiosqlite
104-
memory = Memory("~/.contribai/memory.db")
105-
await memory.init()
106-
await memory.record_outcome(repo, pr_number, url, type, "merged")
107-
prefs = await memory.get_repo_preferences(repo)
108-
```
109-
110-
## File Organization Rules
111-
112-
- **Code files only**: ContribAI only modifies `.py`, `.js`, `.ts`, `.go`, `.rs` etc.
113-
- **Never modify**: `LICENSE`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `.github/FUNDING.yml`
114-
- **Skip extensions**: `.md`, `.yaml`, `.json`, `.toml`, `.cfg`, `.ini`
115-
- **Protected meta files**: Any governance/meta files are off-limits
116-
117-
## Testing
10+
Before submitting changes, run:
11811

11912
```bash
120-
pytest tests/ -v # 333 tests
121-
pytest tests/ -v --cov=contribai # With coverage (threshold: 50%)
122-
```
123-
124-
Test structure:
125-
```
126-
tests/
127-
├── unit/ # Unit tests for each module
128-
│ ├── test_analyzer.py
129-
│ ├── test_config.py
130-
│ ├── test_pipeline_v2.py
131-
│ ├── test_github_client.py
132-
│ ├── test_patrol.py
133-
│ └── ...
134-
└── conftest.py # Shared fixtures
13+
cargo fmt --all -- --check
14+
cargo clippy --workspace --all-targets --locked -- -D warnings
15+
cargo test --workspace --locked
13516
```
136-
137-
## Environment Variables
138-
139-
| Variable | Required | Purpose |
140-
|----------|----------|---------|
141-
| `GITHUB_TOKEN` | Yes | GitHub API authentication |
142-
| `GEMINI_API_KEY` | Yes* | Google Gemini LLM |
143-
| `OPENAI_API_KEY` | Alt | OpenAI LLM (alternative) |
144-
| `ANTHROPIC_API_KEY` | Alt | Anthropic LLM (alternative) |
145-
| `GOOGLE_CLOUD_PROJECT` | Opt | Vertex AI project |
146-
147-
## Known Limitations
148-
149-
1. No sandbox execution — ContribAI generates code but doesn't run it
150-
2. Single-repo PRs only — no cross-repo changes
151-
3. No interactive mode — fully autonomous
152-
4. Rate limited by GitHub API (5000 req/hour for authenticated users)
153-
5. Context window limited by LLM provider (varies by model)

.github/dependabot.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ version: 2
33
updates:
44
# Rust dependencies (primary codebase)
55
- package-ecosystem: "cargo"
6-
directory: "/crates/contribai-rs"
6+
directory: "/"
77
schedule:
88
interval: "weekly"
99
day: "monday"

.github/pull_request_template.md

Lines changed: 47 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,48 @@
1-
## Description
2-
<!-- What does this PR do? Why is it needed? -->
3-
4-
## Type
5-
- [ ] `feat` – New feature
6-
- [ ] `fix` – Bug fix
7-
- [ ] `refactor` – Code restructuring
8-
- [ ] `docs` – Documentation
9-
- [ ] `test` – Tests
10-
- [ ] `perf` – Performance
11-
- [ ] `chore` – Maintenance
12-
13-
## Changes
14-
<!-- List the key changes made -->
15-
16-
## Architecture Area
17-
<!-- Which v2.5.0 component does this touch? -->
18-
- [ ] Middleware chain (`core/middleware.py`)
19-
- [ ] Analysis / Skills (`analysis/analyzer.py`, `analysis/skills.py`)
20-
- [ ] Sub-agents (`agents/registry.py`)
21-
- [ ] Tools (`tools/protocol.py`)
22-
- [ ] Memory / Learning (`orchestrator/memory.py`)
23-
- [ ] PR Patrol (`pr/patrol.py`)
24-
- [ ] Pipeline (`orchestrator/pipeline.py`)
25-
- [ ] Other: <!-- specify -->
26-
27-
## Pre-submit Checklist
28-
29-
> **⚠️ CI will auto-run on your PR. Please verify locally before pushing.**
30-
31-
- [ ] `ruff check contribai/` passes (lint)
32-
- [ ] `ruff format --check contribai/ tests/` passes (format)
33-
- [ ] `pytest tests/ -v` passes (356+ tests)
34-
- [ ] Code follows project conventions (async, type hints, Google docstrings)
35-
- [ ] `from __future__ import annotations` at top of new files
36-
- [ ] No hardcoded secrets
37-
- [ ] DCO signoff on all commits (`git commit -s`)
38-
39-
## Related Issues
1+
## Why
2+
3+
<!-- What maintainer/user problem does this solve? Link an issue when available. -->
4+
5+
## What changed
6+
7+
<!-- Keep this concrete and scoped. -->
8+
9+
## Trust and safety impact
10+
11+
- [ ] No external-write, authentication, credential, sandbox, workflow, or release behavior changed
12+
- [ ] Safety-sensitive behavior changed and the threat model / deny-path tests were updated
13+
14+
Explain any new capability, permission, network destination, persisted data, or residual risk:
15+
16+
## Verification
17+
18+
- [ ] `cargo fmt --all -- --check`
19+
- [ ] `cargo clippy --workspace --all-targets -- -D warnings`
20+
- [ ] `cargo test --workspace`
21+
- [ ] `cargo build --workspace --release`
22+
- [ ] User-facing docs/config examples match the implementation
23+
24+
Commands and notable results:
25+
26+
```text
27+
28+
```
29+
30+
## AI assistance
31+
32+
- [ ] No meaningful AI assistance
33+
- [ ] AI assisted this change; I reviewed every changed file and remain accountable for it
34+
35+
If assisted, name the tool/model if known and summarize what the human verified:
36+
37+
## Checklist
38+
39+
- [ ] The change is focused and does not reward unsolicited contribution volume
40+
- [ ] New GitHub writes are explicit, consented, bounded, and fail closed
41+
- [ ] No bot or agent performs a legal attestation for a person
42+
- [ ] No secrets, private code, or personal data were added
43+
- [ ] Dependencies and copied material are license-compatible
44+
- [ ] Breaking behavior and migrations are documented
45+
46+
## Related issues
47+
4048
<!-- Closes #123 -->

0 commit comments

Comments
 (0)