diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 4901055376bc..56230f2838ad 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -16,4 +16,11 @@ B | A ### 🏁 Checklist -- [ ] Tests written, or not not needed +- [ ] ⛑️ Tests (unit and/or integration) are included or not needed +- [ ] 🔙 Backport requests are created or not needed: `/backport to stable-xx.x` +- [ ] 📅 Milestone is set +- [ ] 🌸 PR title is meaningful (if it should be in the changelog: is it meaningful to users?) + +## 🤖 AI (if applicable) + +- [ ] The content of this PR was partly or fully generated using AI diff --git a/AGENTS.md b/AGENTS.md index 9d4681f839b6..5fdd984bd590 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -124,6 +124,32 @@ All code is validated with the following tools. Fix findings in modified files: Run all checks with: `./gradlew check` +## Nextcloud Contribution Policy + +All contributions generated or assisted by this agent must fully comply with: + +- **[AI Contribution Policy](https://github.com/nextcloud/.github/blob/master/AI_POLICY.md)** - the primary reference for AI-specific rules, covering disclosure, author accountability, communication, security, licensing, code quality, and autonomous agent behavior. +- **[Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)** - covering testing requirements, the Developer Certificate of Origin (DCO), license headers, conventional commits, and translations. These apply in full to all contributions regardless of how they were produced. + +### What this agent must always do + +- Add an `Assisted-by: AGENT_NAME:MODEL_VERSION` git trailer to every commit containing AI-assisted content. +- Ensure every pull request includes a disclosure of AI tool use in the PR description. +- Produce focused, scoped pull requests that address exactly one concern. Do not touch unrelated files or introduce incidental refactors. +- Verify all dependencies against actual package registries before suggesting them. Do not use hallucinated or unverified package names. +- Explicitly inform the contributor when any action they are about to take, or have taken, would violate the AI Contribution Policy or the Contribution Guidelines. Do not silently proceed. State which rule is at risk and what the contributor should do instead. +- Warn the contributor if a pull request is growing too large. A PR approaching several thousand lines of changed code is a signal that it should be split into smaller, focused PRs. Suggest a logical split before the PR is opened, not after. +- Recommend opening a ticket for discussion before starting implementation whenever a feature or change is sufficiently complex - for example when it touches multiple subsystems, requires architectural decisions, or the right approach is not yet clear. A ticket allows maintainers and the contributor to align on direction before code is written, avoiding wasted effort on a PR that may be rejected or require fundamental rework. + +### What this agent must never do + +- Open issues, submit pull requests, post review comments, or send security reports autonomously. Every contribution must be reviewed and submitted by a human. +- Add `Signed-off-by` tags to commits. Only the human contributor can certify the Developer Certificate of Origin. +- Generate or submit security reports without independent human verification. Report verified vulnerabilities via [HackerOne](https://hackerone.com/nextcloud), not as GitHub issues. +- Write PR descriptions, review comments, or issue reports on behalf of the contributor. These must be in the contributor's own words. +- Fully automate the resolution of issues labeled [`good first issue`](https://github.com/issues?q=org%3Anextcloud+label%3A%22good+first+issue%22) or similar beginner-friendly labels. +- Submit code that has not been reviewed and cleaned up by the contributor. Dead code, redundant logic, excessive comments, and unrelated changes must be removed before submission. + ## Commit and Pull Request Guidelines ### Commits @@ -132,22 +158,14 @@ Run all checks with: `./gradlew check` - Commit messages must follow the [Conventional Commits v1.0.0 specification](https://www.conventionalcommits.org/en/v1.0.0/#specification) — e.g. `feat(chat): add voice message playback`, `fix(call): handle MCU disconnect gracefully`. -- Every commit made with AI assistance must include an `AI-assistant` trailer identifying the coding agent, its version, and the model(s) used: - - ``` - AI-assistant: Claude Code 2.1.80 (Claude Sonnet 4.6) - AI-assistant: Copilot 1.0.6 (Claude Sonnet 4.6) - ``` - - General pattern: `AI-assistant: ( )` - - If multiple models are used for different roles, extend the trailer with named roles: +- Every commit made with AI assistance must include an `Assisted-by: AGENT_NAME:MODEL_VERSION` git trailer identifying the coding agent and model used: ``` - AI-assistant: OpenCode v1.0.203 (plan: Claude Opus 4.5, edit: Claude Sonnet 4.5) + Assisted-by: ClaudeCode:claude-sonnet-4-6 + Assisted-by: Copilot:claude-sonnet-4-6 ``` - Pattern with roles: `AI-assistant: (: , : )` + General pattern: `Assisted-by: :` ### Pull Requests diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 000000000000..43c994c2d361 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1 @@ +@AGENTS.md diff --git a/REUSE.toml b/REUSE.toml index 58c20a299d7c..1fda7dfdbb65 100644 --- a/REUSE.toml +++ b/REUSE.toml @@ -30,7 +30,7 @@ SPDX-FileCopyrightText = "2015-2016 ownCloud Inc." SPDX-License-Identifier = "GPL-2.0-only" [[annotations]] -path = ["app/libs/local-maven/**/*.aar", "app/libs/local-maven/**/*.pom"] +path = ["CLAUDE.md", "app/libs/local-maven/**/*.aar", "app/libs/local-maven/**/*.pom"] precedence = "aggregate" SPDX-FileCopyrightText = "2026 Nextcloud GmbH and Nextcloud contributors" SPDX-License-Identifier = "AGPL-3.0-or-later"