tools: welcome first-time contributors

[panva]

Add contribution guidance and an advisory AgentScan warning for first-time pull request authors.

[nodejs-github-bot]

Review requested:

• @nodejs/actions

[jasnell]

Worth a try to see if it's effective

[panva]

Perhaps flagging multiple PRs from FIRST_TIME_CONTRIBUTOR could be added to this workflow or to a follow-on change?

It can be a prose in the text. I wouldn't run expensive policy queries in this workflow. Please make a suggestion.

[MikeMcC399]

Perhaps flagging multiple PRs from FIRST_TIME_CONTRIBUTOR could be added to this workflow or to a follow-on change?

It can be a prose in the text. I wouldn't run expensive policy queries in this workflow. Please make a suggestion.

Thanks for the response! The text is fine for the first contribution, and if they have read the guidance, they shouldn't be submitting multiple PRs anyway.

I hadn't considered the cost of additional queries and I understand your concern.

So I'm not going to suggest a change after all!

[Renegade334]

Example run: nodejs/node-auto-test#100 (comment)

Example with positive agentscan: nodejs/node-auto-test#101 (comment)
@panva I think the indentation looks a bit janky?

(sorry for accidentally closing, was on the wrong tab 😞)

[panva]

Example with positive agentscan: nodejs/node-auto-test#101 (comment)

I'll reflow the caution block

[panva]

@Renegade334 can you test again?

[Renegade334]

nodejs/node-auto-test#102 (comment)

LGTM!

[nodejs-github-bot]

Landed in 0befff5

[MikeMcC399]

Now that this has landed, we see in the first PR (65582) that it needs an approval to run:

I guess there is no way to avoid that.

[panva]

@MikeMcC399 The workflow actually ran, didn't need approval but author_association was NONE for some reason and so it evaluated to a skip. Although now the API reports FIRST_TIME_CONTRIBUTOR so this may be a race condition in github's metadata between the event and the API.

[panva]

I've disabled the workflow for now while searching for a workaround.

[MikeMcC399]

I'm also suspicious at the moment of GitHub results, as we've discussed in Slack concerning problems with cron jobs and cloning into Jenkins.

[panva]

Ok, i'll re-enable the workflow and observe for a bit before following up with using gh api to query the PR author_association instead.

[panva]

Followup in #65592. I wouldn't fast-track it, if anything the two days will give us more opportunity to observe the behaviour.