bot-signatures.js

/**
 * Curated, versioned signatures that identify non-human committers — AI coding
 * agents AND automation bots (dependabot, github-actions, ...). For the Vibe
 * Index, any of these counts as "not hand-written by a human".
 *
 * IMPORTANT: these patterns are matched against commit *identities* — the
 * author "Name <email>" and each "Co-Authored-By:" identity — NOT against the
 * free-text commit message. They are deliberately anchored to vendor email
 * domains and bot-account markers so that a human who merely mentions an AI in
 * a message, or who happens to be named "Claude", is never misclassified.
 *
 * This list is maintained with the action and expanded in new releases. Users
 * do NOT edit this file: they add their own regexes via the `extra-bot-patterns`
 * input, which is merged on top of these signatures at run time.
 *
 * Each entry is a case-insensitive RegExp tested against an identity string
 * such as `Claude <noreply@anthropic.com>` or `dependabot[bot] <...>`.
 *
 * Last reviewed: 2026-08-07
 */
const BOT_SIGNATURES = [
  // GitHub App / automation bot accounts: "dependabot[bot] <...>",
  // "github-actions[bot] <...>", "renovate[bot] <...>".
  /\[bot\]/i,

  // Anthropic — Claude / Claude Code sign as "Claude <...@anthropic.com>".
  /@anthropic\.com\b/i,

  // OpenAI — ChatGPT / Codex service identities.
  /@openai\.com\b/i,

  // GitHub Copilot coding agent: "Copilot <...@users.noreply.github.com>".
  /\bcopilot\b[^<]*<[^>]*@users\.noreply\.github\.com>/i,

  // JetBrains Junie: "Junie <junie@jetbrains.com>". Anchored to the name so
  // that human JetBrains employees on the same domain stay human.
  /\bjunie\b[^<]*<[^>]*@jetbrains\.com>/i,

  // Cursor agent.
  /@cursor\.(com|sh)\b/i,

  // Devin (Cognition Labs).
  /@(devin\.ai|cognition\.ai|cognition-labs\.com)\b/i,

  // Sourcegraph Cody, Codeium / Windsurf service accounts.
  /@(sourcegraph\.com|codeium\.com|codeiumdev\.com)\b/i,
];

module.exports = { BOT_SIGNATURES };