feat: add evidence-first contributor trust action

.github/workflows/test.yml

@@ -0,0 +1,20 @@
+name: Test
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+      - run: npm test

.gitignore

@@ -81,6 +81,8 @@ out
 # Nuxt.js build / generate output
 .nuxt
 dist
+!dist/
+!dist/index.mjs
 .output
 
 # Gatsby files

README.md

@@ -1 +1,50 @@
-# contributor-trust-action
+# Contributor Detection Action
+
+Detects likely automated contributors from public GitHub evidence for a pull request, issue, or issue comment. It reads public profile and activity data, optionally asks GitHub Models for a second opinion, and updates one detection comment and label.
+
+The action does not infer identity from writing style or treat AI disclosure as misconduct. Organization blocking is opt-in and limited to high-risk user accounts that GitHub Models classifies as likely automated with at least 90% confidence. GitHub App bot accounts are reported but never organization-blocked by this workflow.
+
+## Usage
+
+```yaml
+name: Contributor detection
+
+on:
+  issues:
+    types: [opened]
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+  models: read
+
+jobs:
+  detection:
+    if: github.actor != 'github-actions[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: Open-Source-Bazaar/contributor-trust-action@v1
+        with:
+          github-token: ${{ github.token }}
+          organization-token: ${{ secrets.PAT }}
+          block-high-confidence-automation: 'true'
+```
+
+The action never checks out or executes code from an external pull request. GitHub Models is best-effort: if Models is disabled, the public-evidence report still completes.
+
+## Outputs
+
+- `author`
+- `risk-level`: `low`, `medium`, or `high`
+- `risk-score`: `0` to `100`
+- `report-json`
+- `blocked`: `true` when the organization block request succeeded
+
+Set `fail-on-high-risk: 'true'` only after reviewing the action against your community's contribution patterns.
+
+`organization-token` must be a dedicated fine-grained PAT or GitHub App token with organization `Blocking users: write`. Keep blocking disabled when that permission is not intentionally configured.

action.yml

@@ -0,0 +1,51 @@
+name: Contributor Detection
+description: Detect high-confidence automated contributors from public GitHub evidence.
+author: Open-Source-Bazaar contributors
+
+inputs:
+  github-token:
+    description: GitHub token with read access and permission to comment or label.
+    required: true
+  organization-token:
+    description: Optional organization token with Blocking users write permission.
+    required: false
+  block-high-confidence-automation:
+    description: Block high-confidence automated user accounts when an organization token is provided.
+    required: false
+    default: 'false'
+  ai-review:
+    description: Use GitHub Models for a second, evidence-grounded review.
+    required: false
+    default: 'true'
+  model:
+    description: GitHub Models model identifier.
+    required: false
+    default: openai/gpt-4.1
+  comment:
+    description: Create or update the contributor report comment.
+    required: false
+    default: 'true'
+  fail-on-high-risk:
+    description: Fail the workflow when the report is high risk.
+    required: false
+    default: 'false'
+
+outputs:
+  author:
+    description: Contributor login that was inspected.
+  risk-level:
+    description: low, medium, or high.
+  risk-score:
+    description: Numeric risk score from 0 to 100.
+  report-json:
+    description: Machine-readable report.
+  blocked:
+    description: Whether the contributor was blocked from the organization.
+
+runs:
+  using: node24
+  main: dist/index.mjs
+
+branding:
+  icon: shield
+  color: blue