contributing: update guidelines for AI-generated code

[ngxson]

Requires disclosing usage of AI for:

• PRs (contributors /collaborators) - this excludes usage of AI for trivial tab auto-completions
• Security reports

[JohannesGaessler]

Previously there have been instances where people submit autogenerated PRs that don't even compile. However, I don't think we need to make the code compiling and working correctly an explicit requirement as that should be a given for any PR.

[ngxson]

I think an AI-generated PR not compiling is less problematic than one that compiles, but containing bunch of hidden bugs that human maintainers have to spend time to trace & review.

Btw, this also extend to documentation, where AI can generate fairly convincing docs, but yet still containing some subtle mistakes.

[JohannesGaessler]

Should we add something like this?

Please ensure that you fully understand the code you submit.

Please ensure that you have the ability to fix problems with or make changes to your code without the use of AI if necessary.

Edit: I guess the first point is already covered via requiring a "thorough review".

[ngxson]

I think the term "thorough review" is more suitable in the context, as a "thorough review" implies that contributor must already understand the code

For the second point, "without the use of AI" can potentially contradict the "Using AI to generate PRs is permitted" part 😅

I think "thorough review" is quite concise while still sounds "professional" though

[CISC]

Honestly though, my default assumption is normally that any given PR is at least in large parts AI-generated, looking for signs that at least some of it is written by a human. :)

[ngxson]

Wondering though, we also have the copilot-instructions.md, maybe we can also specify this in the instructions, so copilot can leave some explicit disclosures about itself.

But not sure if that works with other AI agents like claude/gemini CLI

Edit: tried, but it doesn't work; the vscode's copilot ignore the instruction, even though it clear read the file

[CISC]

But not sure if that works with other AI agents like claude/gemini CLI

We can consider moving copilot-instructions.md to root AGENTS.md as copilot supports that now.