action.yml

# SPDX-FileCopyrightText: 2026 German Federal Office for Information Security (BSI) <https://www.bsi.bund.de>
# Software-Engineering: 2026 Intevation GmbH <https://intevation.de>
#
# SPDX-License-Identifier: Apache-2.0

name: 'AI Contribution Detection'
description: 'A GitHub Action checking if a contribution was made with AI'
author: 'CSAF Tools Development Community'

inputs:
  fail-on-detection:
    description: 'Exit with a non-zero status code when LLM co-authorship is detected'
    required: false
    default: 'true'
  comment-on-detection:
    description: Post a PR comment when LLM co-authorship is detected
    required: false
    default: 'false'

runs:
  using: composite
  steps:
    - uses: actions/checkout@v6
      with:  # fetch complete history, not just the last commit
        fetch-depth: 0

    - name: Check commits for LLM co-authors
      id: llm-check
      shell: bash
      env:
        BASE_SHA: ${{ github.event.pull_request.base.sha }}
        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        FAIL_ON_DETECTION: ${{ inputs.fail-on-detection }}
        COMMENT_ON_DETECTION: ${{ inputs.comment-on-detection }}
        GH_TOKEN: ${{ github.token }}
        PR_NUMBER: ${{ github.event.pull_request.number }}
        REPO: ${{ github.repository }}
      run: |
        # LLM tool co-author patterns
        # Examples:
        # Co-authored-by: GitHub Copilot <copilot@github.com>
        # Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
        # Co-authored-by: Claude <claude@users.noreply.github.com>
        LLM_COAUTHOR_PATTERNS=(
          'co-authored-by:.*(github-)?copilot'
          'co-authored-by:.*claude'
          'co-authored-by:.*chatgpt'
          'co-authored-by:.*gemini'
          'co-authored-by:.*cursor'
          'co-authored-by:.*tabnine'
          'co-authored-by:.*codeium'
          'co-authored-by:.*amazon q'
          'co-authored-by:.*continue'
        )

        LLM_AUTHOR_PATTERNS=(
          'github-copilot\[bot\]'
          'copilot-swe-agent'
          'devin-ai-integration\[bot\]'
          'sweep-ai\[bot\]'
          'coderabbit-ai\[bot\]'
          'autofix-ci\[bot\]'
          'cursor-ai'
          'claude@anthropic\.com'
        )

        FOUND_COMMITS=""
        FOUND_ANY=false

        while IFS= read -r commit; do
          # Check commit messages
          msg=$(git show -s --format="%B" "$commit")
          author=$(git show -s --format="%an <%ae>" "$commit")
          subject=$(git show -s --format="%s" "$commit")

          for coauthor_pattern in "${LLM_COAUTHOR_PATTERNS[@]}"; do
            if echo "$msg" | grep -iqE "$coauthor_pattern"; then
              short=$(git show -s --format="%h" "$commit")
              FOUND_COMMITS="${FOUND_COMMITS}\n- \`${short}\` ${subject} (co-author matched: \`${coauthor_pattern}\`)"
              FOUND_ANY=true
              break
            fi
          done

          # Check commit authors
          author_pattern=$(IFS='|'; echo "${LLM_AUTHOR_PATTERNS[*]}")
          if echo "$author" | grep -iqE "$author_pattern"; then
            short=$(git show -s --format="%h" "$commit")
            FOUND_COMMITS="${FOUND_COMMITS}\n- \`${short}\` ${subject} (author matched: \`${author}\`)"
            FOUND_ANY=true
          fi
        done < <(git log --format="%H" "${BASE_SHA}..${HEAD_SHA}")

        if $FOUND_ANY; then
          REPORT="$(
            echo "### LLM co-authorship detected"
            echo ""
            echo "One or more commits appear to have been (co-)authored by an LLM tool:"
            echo ""
            echo -e "$FOUND_COMMITS"
          )"
          echo "$REPORT" >&2
          echo "$REPORT" >> "$GITHUB_STEP_SUMMARY"
          if [[ "$COMMENT_ON_DETECTION" == "true" ]]; then
            gh api "repos/${REPO}/issues/${PR_NUMBER}/comments" \
              --method POST \
              --field body="$REPORT"
          fi
          if [[ "$FAIL_ON_DETECTION" == "true" ]]; then
            exit 1
          fi
        fi