tools: refine contributor guidance workflow

[panva]

Use the Node.js GitHub bot token for association checks and route the welcome and caution messages independently. Any outside contributor (other than dependabot) regardless of being associated as first time or not goes through agentscan (it's a signal we should surface to aid moderation).

Also labels either agentscan:community-flagged , agentscan:automated-account , or agentscan:mixed-signals accordingly.

Followup to #65592, #65533, and #65648. See #65648 (comment)

[nodejs-github-bot]

Review requested:

• @nodejs/actions

[mcollina]

lgtm

[panva]

It's intentionally a bit wide at the moment and can be narrowed down when it runs a few times. The workflow is a new one that can be disabled if need be, it won't disrupt existing workflows.

flowchart TD
    opened["PR opened"] --> gate{"Free event pre-filter"}

    gate -->|"FIRST_TIMER / FIRST_TIME_CONTRIBUTOR / CONTRIBUTOR / NONE"| resolve["Resolve association using GH_USER_TOKEN"]
    gate -->|"Anything else, Dependabot, or a rerun"| skip["Skip without allocating a runner"]

    resolve -->|"FIRST_TIMER / FIRST_TIME_CONTRIBUTOR"| first["First-time contributor"]
    resolve -->|"CONTRIBUTOR / NONE after retries"| external["External contributor without a welcome"]
    resolve -->|"Trusted association"| stop["Stop without scanning or commenting"]
    resolve -->|"API error / unexpected value"| failure["Fail resolver; no scan or comment"]

    first --> firstScan["Run AgentScan"]
    firstScan -->|"Successful positive signal"| welcomeCaution["Apply labels and post welcome + caution"]
    firstScan -->|"No signal or scan failure"| welcome["Post welcome only"]

    external --> externalScan["Run AgentScan"]
    externalScan -->|"Successful positive signal"| caution["Apply labels and post caution only"]
    externalScan -->|"No signal or scan failure"| noComment["No comment"]

Loading

[bnb]

love to see further AgentScan integration <3