[doc] need a CONTRIBUTING.md document?

[robrwo]

I was looking for a document about how to contribute bug reports, security reports code and documentation changes.

On a related note, it might be wise to amend such a document with a policy regarding AI-generated contributions. See the one for Servo https://book.servo.org/contributing.html#ai-contributions

[Grinnz]

perlhack, perlpolicy, perlsecpolicy, perldocstyle are probably the most relevant documentation here, for more specific topics than covered by README.

[Grinnz]

As for adding a policy like you mentioned, the appropriate place is probably perlpolicy, but the mechanism for officially adopting such is trickier, probably involving consensus among the core team and/or p5p list.

[haarg]

This is basically the same issue as #21806

[guest20]

@haarg it is similar to #21806 except for the "Manually created bugs only please" part, which I think is a good point to address.

@robrwo This project is in a repo on github.com, I'm not sure every project on github needs to include instructions on landing a pull request on github‡, and the 🛡 Security tab is already active, so it feels pretty discoverable - except for all that stuff I was complaining about in #21806 obviously

Maybe the wiki and projects tabs could be turned off to de-clutter that ... upper area a little
__
‡. even if github is getting progressively more and more aggressively enshitified

[robrwo]

@guest20:

even if github is getting progressively more and more aggressively enshitified

It's not just GitHub's CoPilot. See https://www.reddit.com/r/perl/comments/1k28860/i_just_patched_the_neovimext_perl_module_with/

I decided to run an experiment and see if Claude Code could handle this since I don't have nearly enough knowledge about Neovim to do it myself.
...
After about 20 min of prompting and approving Claude's actions blindly, it was able to fix the issue, get the tests to pass, install the patched module, and submit the patch to the repo. It would have gone even faster if I had my git authentication set up properly so Claude could use it out of the box. Claude even fixed that problem for me, too. The only work I had to do was patiently sip on my coffee between approving Claude's suggestions.

So the issue is people submitting AI-generated slop they don't understand. Or worse, someone prompted it to generate code with a really subtle security hole.

But anyhow as @Grinnz noted, rules around AI-generated contributions should be discussed in P5P. (However, I do think such rules, once agreed upon, should be noted in a contributions document.)

[Leont]

perlhack, perlpolicy, perlsecpolicy, perldocstyle are probably the most relevant documentation here, for more specific topics than covered by README.

As for adding a policy like you mentioned, the appropriate place is probably perlpolicy, but the mechanism for officially adopting such is trickier, probably involving consensus among the core team and/or p5p list.

Yeah so then we should add a small CONTRIBUTING.md that points people in those directions.

[bulk88]

On a related note, it might be wise to amend such a document with a policy regarding AI-generated contributions. See the one for Servo https://book.servo.org/contributing.html#ai-contributions

I'm going to bet in at least 1 jurisdiction somewhere on earth in the past, there was a criminal trial, that the GPL violates multiple human trafficking and un-free labour laws https://en.wikipedia.org/wiki/Forced_labour . You can't work for nothing. That is what every house maid "aunt"/"cousin" with no genetic connection and doesn't speak the local govt language tells every local/international LE investigator during a raid. No $$$ == crime. 1st world parts of Europe makes it illegal to take outdoor photographs in a public space under the same logic. See also https://vtuhr.org/articles/10.21061/vtuhr.v5i1.43 https://www.investopedia.com/terms/s/stranger-owned-life-insurance-stoli.asp

If GPL/FOSS was ruled illegal. It was dismissed much later on appeals court or withdrawn a year or 2 later by the next PM/president in office, and a non-issue by 2000. Recent 2020s SBOM laws/regulations (Software Bill of Materials) are getting very close to making GPL & friends illegal again. Although it seems to me EU constitutional court is going to do some surgery on that law in the near future, to add a "was the GPL software written by the paid staff developers of a >25 or >6 employee for-profit company" section to that law.

[book]

But anyhow as @Grinnz noted, rules around AI-generated contributions should be discussed in P5P.

Indeed. It's probably good to think about this before it inevitably happens.

In the reddit post link above, the OP also writes:

And like any other patch, the maintainer with more expertise will have to review it before approving it.

And that is likely the biggest threat for us, as "maintainer with more expertise" is a scarce resource for the Perl core.