Added LLM guidelines to the documentation

[scarlehoff]

As discussed in Morimondo. Let me know if you'd like to modify anything.

[felixhekhorn]

• There is the case of dependabot - which is clearly no LLM, but also not a human. I'm still quite in favor of allowing that since it fixes known security problems with a simple (typically few line) change in a lock file. Should we mention it explicitly someway?
• There is the case of pre-commit: we already removed the autoupdate from all repos (I think). Should we explicitly discourage autofix (and autoupdate)?

[scarlehoff]

They changed the interface ever so slightly and I am now many years old, so I manage to write my reply to you as the commit msg instead of here, lol
I'll rebase later to amend that because I feel very silly.

There is the case of dependabot - which is clearly no LLM, but also not a human. I'm still quite in favor of allowing that since it fixes known security problems with a simple (typically few line) change in a lock file. Should we mention it explicitly someway?

You know my opinion on dependabot is quite different :_)

But that said, it is not LLM-generated and it is not prompted by a human anyway so I think it doesn't belong here. If there were a case of "we need to bump this library because of this specific feature" I would prefer that to be in the commit rather than simply "bump to version x".

There is the case of pre-commit: we already removed the autoupdate from all repos (I think). Should we explicitly discourage autofix (and autoupdate)?

What do you mean? In general the changes should come "pre-committed" in the PRs (but again, a separate problem)
In /this/ repository in particular we have the problem that we still have pre-pre-commit code so sometimes the files get huge unwarranted changes but that should not happen in the others (and it is happening less and less here)

[felixhekhorn]

What do you mean? In general the changes should come "pre-committed" in the PRs (but again, a separate problem)

yes, but for lazy people you can also let the CI (= a bot) do that job for you. We could add a sentence á là "We discourage the use of autofix and autoupdate with pre-commit.ci" or similar if we consider that necessary. (I'm just looking to the contributors in our repos.)

[scarlehoff]

For me they are a different category as they don't add features nor they solve bugs. They increase the noise, as one has to go one commit down in the blame to find who introduced some particular change, but they don't hide attribution.

I'm generally against anything that touches the code without a human at the helm, but not enough to write it in stone I think.