[Dumbris]

What

Experiment E5: when an external contributor's PR is merged, a bot posts one thank-you comment with an optional, copy-paste share snippet, and release notes credit external contributors.

• .github/workflows/contributor-thanks.yml — pull_request_target: closed (merged only) + workflow_dispatch for manual dry runs.
• scripts/contributors.sh — thanks <pr> and release <prev-tag> <ref>; scripts/test-contributors.sh — 26 offline checks.
• release.yml — new "Collect contributors" step; a ## Contributors section is appended after the LLM-written notes (deterministic, so a name is never dropped or invented). Existing tooling did not credit anyone: notes are LLM-summarised commit subjects, git-cliff CHANGELOG.md has no author section.
• CONTRIBUTING.md — short "Recognition" note.

Skipped: author Dumbris, algis-dumbris, any [bot]/Bot type, and association OWNER/MEMBER. Posted as github-actions[bot], never as Algis. Nothing is posted on the contributor's behalf.

Comment wording — please approve (rendered for PR #1222, first-time author)

<!-- contributor-thanks:v1 -->   (hidden marker, used for idempotency)
Thank you @loloDawit! Your PR "fix(test): restore the registry SSRF allow-policy after loopback fixtures" is merged and will ship in the next release.

This is your first merged contribution to MCPProxy. Welcome, and congratulations!      <- only if first-time

If you would like to mention it, here is a snippet you can copy and edit:

```text
My PR to MCPProxy, an open-source MCP proxy for Claude Code, Codex and Cursor, just got merged: https://github.com/smart-mcp-proxy/mcpproxy-go/pull/1222
Repo: https://github.com/smart-mcp-proxy/mcpproxy-go
```

Sharing genuinely helps a small open-source project get found. It is entirely optional, and we are grateful either way.

679 chars with the first-time line (~600 without); ASCII only. "next release" is used because the release isn't known at merge time. The PR title is sanitised (one line, @ neutralised, backticks/brackets/angle brackets stripped, 120 chars max).

Release-notes section (example, release v0.70.0 v0.71.1 run read-only):

## Contributors

Thank you to our external contributors for this release: @sb123sb123, @mvanhorn, @AdamMagued, ... @rudycelekli

Rollout — nothing posts until Algis flips it

Every run is a dry run (comment printed in the job log, nothing posted) until the repo variable CONTRIBUTOR_THANKS_LIVE is true:
gh variable set CONTRIBUTOR_THANKS_LIVE --body true -R smart-mcp-proxy/mcpproxy-go
Manual dry run for any merged PR: Actions > Contributor Thanks > Run workflow (it only posts if the variable is true AND dry_run is unchecked).

Security (pull_request_target)

Checks out only the default branch (sparse-checkout: scripts/contributors.sh, persist-credentials: false); never PR head code. PR data comes via the API, is passed through env/quoted args only, never interpolated into shell. permissions: {} at top, job gets contents: read, pull-requests: write, issues: write. Per-PR concurrency group + marker check (bot-authored comments only) for idempotency.

Testing

• bash scripts/test-contributors.sh — 26/26 (eligibility, template, length < 900, no non-ASCII, hostile titles).
• Read-only dry runs against real PRs: fix(test): restore the registry SSRF allow-policy after loopback fixtures #1222 (first-time=true), fix: do not cut multi-byte runes when truncating error and diagnostic text #1664 (repeat, first=false), docs(server): reattach recordToolCallAt doc comment #1690 (maintainer -> skipped). release v0.70.0 v0.71.1 produced the list above.
• actionlint clean on contributor-thanks.yml; release.yml has the same pre-existing 53 findings before and after (none from the new step). shellcheck -x clean. yamllint not installed. act not installed. No comment was posted anywhere.

Cross-model review (opencode github-copilot/gpt-6.1-sol, high)

• Round 1 (the first attempt exited without a verdict — treated as UNREVIEWED and re-run with a tighter brief): 2 P2 findings, both fixed: (1) any commenter could suppress the thanks by pasting the marker → only github-actions[bot] comments count; (2) search-index lag/incomplete_results could mis-flag first-time → incomplete = not-first (residual race for two first-timer PRs merged within index lag documented and accepted).
• Round 2: VERDICT: CLEAN (also ran mocked-API scenarios: empty comments, human marker, bot marker, later page, incomplete search).

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mcpproxy-docs with    Cloudflare Pages

Latest commit:	9509984
Status:	✅  Deploy successful!
Preview URL:	https://4eaf1bd2.mcpproxy-docs.pages.dev
Branch Preview URL:	https://claude-contributor-spotlight.mcpproxy-docs.pages.dev

View logs

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!