From 3cfa4550626db82f51de9f98518de7ac432e7855 Mon Sep 17 00:00:00 2001
From: Ricci Adams <git@ricciadams.com>
Date: Fri, 11 Sep 2026 09:51:34 -0700
Subject: [PATCH 1/2] Run agentscan if first-contribution left a comment

---
 .github/workflows/pr_welcome.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pr_welcome.yml b/.github/workflows/pr_welcome.yml
index f8b004dc5468..b71cb4478727 100644
--- a/.github/workflows/pr_welcome.yml
+++ b/.github/workflows/pr_welcome.yml
@@ -15,8 +15,10 @@ jobs:
     permissions:
       issues: write
       pull-requests: write
+      contents: read
     steps:
-      - uses: plbstl/first-contribution@2c36bdb58684587f60549a69aaa3ec00b9d5f4fe  # v4.3.3
+      - id: first-contribution
+        uses: plbstl/first-contribution@2c36bdb58684587f60549a69aaa3ec00b9d5f4fe  # v4.3.3
         with:
           labels: first-contribution
           skip-internal-contributors: false
@@ -50,3 +52,16 @@ jobs:
             [Code of
             Conduct](https://github.com/matplotlib/matplotlib/blob/main/CODE_OF_CONDUCT.md).
           issue-opened-msg: ""
+      - name: Run agentscan if first-contribution left a comment
+        if: "${{ steps.first-contribution.outputs.comment-url != '' }}"
+        uses: MatteoGabriele/agentscan-action@c7d61446e7aece6bdd3edcee4558bbfc0392615e  # v2.5.0
+        with:
+          mode: labels
+          scan-pull-requests: true
+          scan-issues: true
+          allowed-users: "meeseeksmachine"
+          label-mixed: "automation: mixed"
+          label-automated: "automation: automated"
+          label-community-flagged: "automation: flagged"
+          auto-close: false
+          honeypot: false

From 62e3277d1df00bdc967d87040cd4097fdf16a814 Mon Sep 17 00:00:00 2001
From: Ricci Adams <git@ricciadams.com>
Date: Fri, 11 Sep 2026 10:40:20 -0700
Subject: [PATCH 2/2] Change commit hash to 2.5.0

---
 .github/workflows/pr_welcome.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr_welcome.yml b/.github/workflows/pr_welcome.yml
index b71cb4478727..e9d33be877cf 100644
--- a/.github/workflows/pr_welcome.yml
+++ b/.github/workflows/pr_welcome.yml
@@ -54,7 +54,7 @@ jobs:
           issue-opened-msg: ""
       - name: Run agentscan if first-contribution left a comment
         if: "${{ steps.first-contribution.outputs.comment-url != '' }}"
-        uses: MatteoGabriele/agentscan-action@c7d61446e7aece6bdd3edcee4558bbfc0392615e  # v2.5.0
+        uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410  # v2.5.0
         with:
           mode: labels
           scan-pull-requests: true