ci: add agentscan

[MatteoGabriele]

🔗 Linked issue

closes #2281

🧭 Context

To keep AI Agents away, we're gonna add AgentScan GitHub App.

📚 Description

I've added the yml file so that once the app is installed, it will be used immediately as options:

• Owner and member are trusted user associations
• I've enabled the honeypot feature, which adds a comment whenever someone not on the trusted list opens a PR. To maintain the npmx first-timer message, there's a separate honeypot message for first-time contributors.
• I've disabled messages, as Nuxt does, and AgentScan will only add tags. The only messages AgentScan will write are the honeypot messages.
• auto-close has not been enabled, but if we want to use it, we can.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview	Aug 5, 2026 8:18pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored	Preview	Aug 5, 2026 8:18pm
npmx-lunaria	Ignored		Aug 5, 2026 8:18pm

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Added automated pull request screening to help identify potential issues and apply appropriate labels.
  • Added guidance for first-time contributors covering automated checks, preview deployments and maintainer review.

Walkthrough

The pull request adds Agentscan configuration for honeypot protection, label mode, trusted contributor associations, and a first-time pull-request message.

Changes

Agentscan configuration

Layer / File(s)	Summary
Configure Agentscan checks .github/agentscan.yml	The configuration defines trusted author roles, honeypot protection, label mode, and guidance for first-time contributors about automated checks, Vercel previews, and maintainer review.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the addition of AgentScan configuration, which is the main change.
Description check	✅ Passed	The description explains the AgentScan configuration, trusted associations, honeypot comments, tagging, and disabled auto-close behaviour.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[graphieros]

At last!