[fzipi]

what

A new pre-merge check, "AI Use Without Disclosure", runs in mode: error and flags a ❌ blocker when a PR shows AI assistance without a real disclosure. A direct signal is enough: an AI tool or agent named in the body, a commit or a comment, an AI Co-Authored-By or "Generated with" line, or an AI bot as commit author. Otherwise it needs two indirect signals, and a thin case passes.

The PR template already ships ## AI Disclosure with **AI usage for this contribution:** None / Used, so the heading alone counts for nothing. The check treats the disclosure as missing when the section is deleted, the answer is unedited or blank, "Used" is left with placeholder rows, or "None" contradicts a direct signal.

The existing "AI Contribution Disclosure" check stays a warning and now only reviews disclosure quality. It accepts the template's table as well as the bullet form; before, every PR that used the template would have been warned. README and AGENTS.md now document the new check and the extra ❌ blocker case.

why

Accounts are opening agent-generated PRs in bulk and dropping the disclosure section. kosoyyagent opened 21 PRs in two days and named Devin on its first four (coreruleset/coreruleset#4903 and #4906–#4908), then removed the section from the rest. One of those, coreruleset/coreruleset#4921, has a commit authored by devin-ai-integration[bot]. The old check only raised a warning for this case.

mode: error blocks merges only when reviews.auto_approvals (request_changes_workflow) is enabled. That setting is still false, because turning it on makes CodeRabbit approve or request changes on every PR in the org, which needs its own decision. Until then the blocker appears in the review but does not stop a merge. The check also runs one PR at a time, so it cannot use an author's disclosures on other PRs.

refs

• AI-CONTRIBUTIONS.md
• coreruleset/coreruleset .github/pull_request_template.md (the AI Disclosure section this check reads)
• CodeRabbit pre-merge checks

ai disclosure

• tools used: Claude (Opus 5.5)
• assisted with: wording of both check instructions and the README/AGENTS.md updates, and drafting this description
• review performed: yamllint -d relaxed and check-jsonschema against the current v2 schema both pass; checked the trigger wording against the coreruleset PR template and the commits of feat: detect php2shell session.upload_progress injection (CVE-2026-109618/109619) coreruleset#4909, #4921 and #4924

[EsadCetiner]

Not an expert in code rabbit, but this looks fine to me.

Do we want to auto-close PRs that don't disclose AI usage? imo those PRs are not worth our attention if AI usage isn't being disclosed.

[fzipi]

If they have a label already, I can autoclose them using my AI 😄 . Which is funny.

[fzipi]

@EsadCetiner For now I'll test how it works, and if it is accurate we can autoclose.