chore: add anti-slop protection for AI-generated spam PRs#642
chore: add anti-slop protection for AI-generated spam PRs#642anandgupta42 merged 2 commits intomainfrom
Conversation
- Install peakoss/anti-slop GitHub Action with user signal checks (account age, profile completeness, merge history), honeypot trap, file protection, and conventional title enforcement - Add AI contributions policy to CONTRIBUTING.md - Add honeypot instruction to PR template for catching AI agents Closes #641 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughIntroduces anti-spam protections: a new GitHub Actions workflow using peakoss/anti-slop, adds a honeypot HTML comment to the PR template, and adds an "AI Contributions Policy" section to CONTRIBUTING.md to define acceptable AI-assisted contributions and prohibit autonomous agent PRs. Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/anti-slop.yml (1)
4-5: Consider re-running checks on PR updates, not just open/reopen.With only
opened/reopened, post-open changes to title/description/commits can bypass this workflow until a reopen.♻️ Suggested trigger expansion
on: pull_request_target: - types: [opened, reopened] + types: [opened, reopened, edited, synchronize]🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/anti-slop.yml around lines 4 - 5, The pull_request_target trigger currently only fires for types [opened, reopened], which misses post-open updates; update the trigger for pull_request_target to include additional event types such as "synchronize" (for new commits) and "edited" (for title/description changes) alongside the existing "opened" and "reopened" so the workflow runs on PR updates as well.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/anti-slop.yml:
- Line 16: Replace the mutable action reference "uses: peakoss/anti-slop@v0"
with a pin to a full commit SHA for peakoss/anti-slop (e.g., "uses:
peakoss/anti-slop@<full-commit-sha>") so the workflow run under
pull_request_target uses an immutable reference; locate the string "uses:
peakoss/anti-slop@v0" in the workflow and update it to the specific commit SHA
from the action's GitHub repo, then commit the change.
---
Nitpick comments:
In @.github/workflows/anti-slop.yml:
- Around line 4-5: The pull_request_target trigger currently only fires for
types [opened, reopened], which misses post-open updates; update the trigger for
pull_request_target to include additional event types such as "synchronize" (for
new commits) and "edited" (for title/description changes) alongside the existing
"opened" and "reopened" so the workflow runs on PR updates as well.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: db5989a3-9284-4c04-acf0-9bb23db09753
📒 Files selected for processing (3)
.github/pull_request_template.md.github/workflows/anti-slop.ymlCONTRIBUTING.md
- Pin `peakoss/anti-slop` to full commit SHA (85daca18) for supply-chain safety since workflow uses `pull_request_target` with write permissions - Add `edited` and `synchronize` triggers so checks re-run on PR updates Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 participant
What does this PR do?
Adds automated detection and a contribution policy to combat low-quality AI-generated spam PRs.
Three changes:
.github/workflows/anti-slop.yml) — runs peakoss/anti-slop on every PR open/reopen. Checks account age, profile completeness, merge history, spam usernames, PR quality, and a honeypot trap. OWNER/MEMBER/COLLABORATOR are auto-exempt.CONTRIBUTING.md) — sets expectations for AI-assisted contributions without being restrictive.Type of change
Issue for this PR
Closes #641
How did you verify your code works?
yaml-lintbun run script/upstream/analyze.ts --markers)Checklist
Summary by CodeRabbit
Documentation
Chores