Hello lovely zizmor users and contributors!

I've had recent issues with spam on other projects that I maintain (thankfully, not zizmor yet). Most of these spam appears to be LLM-originated, which makes it harder for me to automatically bin as spam. In other words, it looks good enough that I spend enough time on it before I realize it's ill-conceived, which is time that ends up wasted (used on that instead of features or more fruitful reviews).

As a result, I'm considering the following changes to zizmor's contribution "policy" (insofar as it exists, which is barely):

• Going forwards, users will have to attest when they use an LLM to generate the contents of a PR. This attestation will be as simple as a checkbox, similar to the checkboxes in the existing issue templates. It'll pretty much say something like "I'm checking this box to disclose the use of an LLM for development."
• Contributors who fail to attest to their LLM usage (if they use LLMs) will be warned the first time. If they fail to disclose their usage a second time, their contribution won't be accepted (I'll close it without reviewing it). Repeated failures to attest will elicit a ban from the @zizmorcore organization, although this will only happen after a final warning (on one of the rejected PRs).

The goal here is not to prevent meaningful LLM-based contributions: there's been a decent number of them already, and I'm happy to continue receiving them! The goal is solely to establish a standard around disclosure, since LLM-based spam is something I expect to eventually deal with.

I'm opening this as a discussion because I'm not 100% sure about the exact dimensions yet, and I'd like to hear feedback on it before going forwards.