tools: refine contributor guidance workflow

[panva]

Use the Node.js GitHub bot token for association checks and route the welcome and caution messages independently. Any outside contributor (other than platform or installed bots) regardless of being associated as first time or not goes through agentscan (it's a signal we should surface to aid moderation).

Also labels either agentscan:community-flagged , agentscan:automated-account , or agentscan:mixed-signals accordingly.

Followup to #65592, #65533, and #65648. See #65648 (comment)

[nodejs-github-bot]

Review requested:

• @nodejs/actions

[mcollina]

lgtm

[bnb]

love to see further AgentScan integration <3

[panva]

flowchart TD
    opened["PR opened"] --> gate{"Free event pre-filter"}

    gate -->|"Non-Bot and association is FIRST_TIMER, FIRST_TIME_CONTRIBUTOR, CONTRIBUTOR, or NONE"| resolve["Resolve association using GH_USER_TOKEN"]
    gate -->|"Bot, trusted association, mannequin, or rerun"| skip["Skip without allocating a runner"]

    resolve -->|"FIRST_TIMER or FIRST_TIME_CONTRIBUTOR"| first["First-time contributor"]
    resolve -->|"CONTRIBUTOR or NONE after retries"| external["External contributor without a welcome"]
    resolve -->|"Trusted association"| stop["Stop without scanning or commenting"]
    resolve -->|"API error or unexpected value"| failure["Fail resolver; no scan or comment"]

    first --> firstScan["Run AgentScan and attempt labels"]
    firstScan -->|"Qualifying output"| welcomeCaution["Post welcome + caution"]
    firstScan -->|"No qualifying output or scan failure"| welcome["Post welcome only"]

    external --> externalScan["Run AgentScan and attempt labels"]
    externalScan -->|"Qualifying output"| caution["Post caution only"]
    externalScan -->|"No qualifying output or scan failure"| noComment["No comment"]

Loading

[MikeMcC399]

@panva

I do hope you cracked the problem with this iteration!

The new labels

• agentscan:community-flagged
• agentscan:automated-account
• agentscan:mixed-signals

would need to be documented.

PR submitters should understand what it means if their PR has had such a label attached.
Collaborators / triagers should be given some guidance on how to proceed.
I'm not sure if the labels should be put into use without documentation.

What do you define as a "mannequin"?

[panva]

I do hope you cracked the problem with this iteration!

I think so. I'm also going to run an emulation of this in a local script to confirm.

PR submitters should understand what it means if their PR has had such a label attached.
Collaborators / triagers should be given some guidance on how to proceed.

That's why the CAUTION_MESSAGE is there.

What do you define as a "mannequin"?

I don't. GitHub does. It is there for completeness, we'll never encounter it in practice. https://docs.github.com/en/migrations/overview/mannequins-and-user-activity

would need to be documented.

I'd say so, in due time when this proves itself useful.

[panva]

I'm also going to run an emulation of this in a local script to confirm.

It's running, logs will appear in https://gist.github.com/panva/76266649dc13fda7955a123cab99fcd2#file-log-txt (assisted-by: codex)