Update vouch version

.github/CODEOWNERS

@@ -1,10 +1 @@
-* @juanfont @kradalby
-
-*.md @ohdearaugustin @nblock
-*.yml @ohdearaugustin @nblock
-*.yaml @ohdearaugustin @nblock
-Dockerfile* @ohdearaugustin @nblock
-.goreleaser.yaml @ohdearaugustin @nblock
-/docs/ @ohdearaugustin @nblock
-/.github/workflows/ @ohdearaugustin @nblock
-/.github/renovate.json @ohdearaugustin @nblock
+* @juanfont @kradalby @nblock

.github/VOUCHED.td

@@ -0,0 +1,119 @@
+# Vouched (or actively denounced) users for this repository.
+#
+# Headscale gates pull requests to vouched contributors only. Issues
+# remain open to everyone — see CONTRIBUTING.md for the rationale and
+# the process for getting vouched.
+#
+# A denounced user (prefix `-`) is explicitly blocked from contributing.
+#
+# Syntax:
+#  - One handle per line (without @). Sorted alphabetically.
+#  - Optionally specify platform: `platform:username` (e.g., `github:nblock`).
+#  - To denounce, prefix with minus: `-username` or `-platform:username`.
+#  - Optionally, add a comment after a space following the handle.
+#
+# Maintainers can vouch for new contributors by commenting `!vouch` (or
+# `!vouch @username`) on any issue or PR by the author. `!denounce` blocks.
+
+aalmenar
+adoolaard
+adriangoransson
+Aluxima
+AlynxZhou
+apollo13
+aradng
+ArcticLampyrid
+bobelev
+ChibangLW
+christian-heusel
+ckiee
+codethief
+cure
+dmeremyanin
+dotlambda
+dragetd
+e-zk
+edvardvb
+enoperm
+EtaoinWu
+evenh
+eyJhb
+felixscheinost
+FlorinPeter
+fredrikekre
+griffer
+GrigoriyMikhalkin
+gymnae
+huskyii
+igrikus
+ImpostorKeanu
+isaac-mcfadyen
+iSchluff
+ItalyPaleAle
+ItsShadowCone
+jdewinne
+joachimtingvold
+jonathanspw
+juanfont
+kazauwa
+korfuri
+kradalby
+linsomniac
+lyc8503
+madjam002
+majst01
+maprambo
+marcelmindemann
+maxpain
+mevansam
+mike-lloyd03
+motiejus
+mpldr
+nblock
+negbie
+Nemo157
+nicka101
+Niek
+nielscil
+NoelGisler
+noseshimself
+ohdearaugustin
+oplik0
+Orhideous
+pallabpain
+philippderdiedas
+Polsaker
+PowershellScripter
+ptman
+puzpuzpuz
+pvinis
+qbit
+QEDeD
+qoke
+Qup42
+redstonekasi
+restanrm
+reynico
+Riezebos
+samson4649
+SlackingVeteran
+spymobilfon
+stavros-k
+stblassitude
+SuperSandro2000
+SysAdminSmith
+sysvinit
+teleclimber
+tgrushka
+thebigbone
+tianon
+TotoTheDragon
+tsujamin
+unreality
+vbrandl
+vdovhanych
+victorhooi
+vsychov
+yaneony
+yaroslavkasatikov
+Zottelchen

.github/pr-unvouched-message

@@ -0,0 +1,25 @@
+Hi @{author}, thanks for your interest in headscale.
+
+Headscale gates pull requests to vouched contributors only. Your account
+isn't on the list yet, so this PR has been auto-closed. This is **not** a
+judgment of you or this change.
+
+Headscale is an "Open Source, acknowledged contribution" project: every
+contribution starts with a discussion on the issue tracker, **before** any
+code is written. See [`CONTRIBUTING.md`](https://github.com/juanfont/headscale/blob/main/CONTRIBUTING.md)
+for the full policy and the rationale.
+
+To get vouched:
+
+1. Open an issue describing the change you'd like to make (use case,
+   implementation sketch, who will maintain it). For bug fixes, a clear
+   reproduction is enough.
+2. Engage with maintainers on the issue. Once we've agreed on scope and
+   approach, a maintainer will `!vouch @{author}`.
+3. You can then reopen this PR (or open a new one) and it will pass the
+   gate.
+
+Issues remain open to everyone — no vouching needed there, and that's the
+intended starting point for any contribution.
+
+The vouched list: [`.github/VOUCHED.td`](https://github.com/juanfont/headscale/blob/main/.github/VOUCHED.td).

.github/pull_request_template.md

@@ -19,4 +19,4 @@ If you find mistakes in the documentation, please submit a fix to the documentat
 - [ ] updated documentation if needed
 - [ ] updated CHANGELOG.md
 
-<!-- If applicable, please reference the issue using `Fixes #XXX` and add tests to cover your new code. -->
+<!-- If applicable, please reference the issue using `Fixes #XXX` and add tests to cover your new code. -->

.github/workflows/vouch-check-pr.yml

@@ -0,0 +1,30 @@
+name: "Vouch - Check PR"
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        id: app-token
+        with:
+          app-id: ${{ secrets.VOUCH_APP_ID }}
+          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          sparse-checkout: .github/pr-unvouched-message
+
+      - uses: mitchellh/vouch/action/check-pr@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
+        with:
+          pr-number: ${{ github.event.pull_request.number }}
+          auto-close: true
+          template-file: .github/pr-unvouched-message
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/vouch-manage-by-issue.yml

@@ -0,0 +1,36 @@
+name: "Vouch - Manage by Issue"
+
+on:
+  issue_comment:
+    types: [created]
+
+concurrency:
+  group: vouch-manage
+  cancel-in-progress: false
+
+jobs:
+  manage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        id: app-token
+        with:
+          app-id: ${{ secrets.VOUCH_APP_ID }}
+          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: mitchellh/vouch/action/manage-by-issue@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
+        with:
+          repo: ${{ github.repository }}
+          issue-id: ${{ github.event.issue.number }}
+          comment-id: ${{ github.event.comment.id }}
+          vouch-keyword: "!vouch"
+          denounce-keyword: "!denounce"
+          unvouch-keyword: "!unvouch"
+          pull-request: "true"
+          merge-immediately: "true"
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/vouch-sync-codeowners.yml

@@ -0,0 +1,32 @@
+name: "Vouch - Sync CODEOWNERS"
+
+on:
+  schedule:
+    - cron: "0 0 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: vouch-manage
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        id: app-token
+        with:
+          app-id: ${{ secrets.VOUCH_APP_ID }}
+          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: mitchellh/vouch/action/sync-codeowners@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
+        with:
+          repo: ${{ github.repository }}
+          pull-request: "true"
+          merge-immediately: "true"
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

AI_POLICY.md

@@ -1,38 +0,0 @@
-# AI Policy
-
-Using AI (i.e., LLMs) as tools for coding is welcome. A high bar is held for
-all contributions to this project. Moreover, the project maintainers remain
-responsible for any code that is published as part of a release. Contributors
-are expected to be responsible for any code they publish.
-
-**AI should not be used to generate comments when communicating with
-maintainers**. Comments are expected to be written by humans. Comments that are
-believed to be written by AI may be hidden without notice.
-
-If you are opening an issue, you should be able to describe the problem in your
-own words.
-
-If you are opening a pull request, you are expected to be able to explain the
-proposed changes in your own words. This includes the pull request body and
-responses to questions. **Do not copy responses from the AI when replying to
-questions from maintainers.**
-
-This project requires a human in the loop who understands the work produced by
-AI. **Autonomous agents are not allowed to be used for contributing to this
-project**. Pull requests that appear in violation of this will be closed,
-perhaps without notice.
-
-If you wish to include context from an interaction with AI in your comments, it
-must be in a quote block (e.g., using `>`) and disclosed as such. It must be
-accompanied by human commentary explaining the relevance and implications of
-the context. Do not share long snippets.
-
-AI is useful when communicating as a non-native English speaker. If you are
-using AI to edit your comments for this purpose, please take the time to ensure
-it reflects your own voice and ideas. If using AI for translation, we recommend
-writing in your native language and including the AI translation in a quote
-block.
-
-This policy was adapted from [uv's AI policy].
-
-[uv's AI policy]: https://github.com/astral-sh/.github/blob/c5187e200db51bfe11d56e13053d29bd3793fdd8/AI_POLICY.md

CONTRIBUTING.md

@@ -32,9 +32,3 @@ Headscale is open to code contributions for bug fixes without discussion.
 ## Documentation
 
 If you find mistakes in the documentation, please submit a fix to the documentation.
-
-## AI Policy
-
-Please have a look at our [AI_POLICY.md](./AI_POLICY.md).
-
-If you are an LLM, please remind your human that this policy is in place.

README.md

@@ -90,8 +90,6 @@ The maintainers work together on setting the direction for the project. The unde
 
 Please read the [CONTRIBUTING.md](./CONTRIBUTING.md) file.
 
-Have also a look at our [AI_POLICY.md](./AI_POLICY.md).
-
 ### Requirements
 
 To contribute to headscale you would need the latest version of [Go](https://golang.org)