feat(ci): thank a contributor after their first merged pull request

[dchaudhari7177]

Resolves: #8292

📝 Summary

One workflow, .github/workflows/contributor-feedback.yml, plus a short section in CONTRIBUTING.md. No custom JavaScript and no custom first-contribution detection — the Action already does that part, and doing it by hand is what the issue asks not to do.

It fires on pull_request_target: closed, and the job runs only when:

if: >-
  github.event.pull_request.merged == true &&
  github.event.pull_request.user.type != 'Bot'

zephyrproject-rtos/action-first-interaction is pinned to 58853996b1ac504b8e0f6964301f369d2bb22e5c (v1.1.1+zephyr.6), which I checked is still the newest tag on that Action — v1.1.1+zephyr.6 is ahead of v1.1.1-zephyr-5 and of v1.1.1, and main has not moved since 2022. Same SHA Zephyr runs today.

Only pr-merged-message is set, so nothing is posted when a pull request is merely opened or closed unmerged.

Why the Action's detection matters

This is the part that would go wrong in a hand-rolled version. A contributor may have had an earlier pull request closed without being accepted:

First pull request:  closed, not merged
Later pull request:  merged        ← the message belongs here

The Action searches the author's previous pull requests and treats the first merged one as the milestone, so the greeting lands on the first real contribution rather than on the first attempt.

Configuration variables, and merging before the survey exists

Both URLs come from configuration variables, never hardcoded:

CONTRIBUTOR_SURVEY_URL
COMMUNITY_URL

Since the issue says the survey URL is still to be created by LibreCode, each sentence is omitted entirely when its variable is unset:

${{ vars.CONTRIBUTOR_SURVEY_URL && format('… {0} …', vars.CONTRIBUTOR_SURVEY_URL) || '' }}

So this can merge now and post a perfectly good message with no survey line at all; the day the variable is set, the line appears with no second pull request. The alternative — a hardcoded placeholder — would either block the merge on the survey or ship a dead link.

Security

• permissions: {} at the top level; the job takes contents: read, pull-requests: read, issues: write, and nothing else. issues: write is required because a comment on a pull request is created through the issues API.
• No actions/checkout, no artifact download, nothing from the head repository is read or executed. The job only reads event metadata and posts a comment, which is the safe shape for pull_request_target.
• The Action is pinned to a full commit SHA, matching the pattern in the rest of .github/workflows/.
• A concurrency group keyed on the pull request number, with cancel-in-progress: false, so a rapid reopen/close cannot produce two comments.

The message

Congratulates them on a first accepted contribution, thanks them for their time and knowledge, makes it explicit they are welcome again and points at the good first issue list, and — only if the variables are set — links the survey and the community. The survey sentence says in as many words that it is optional and that nothing is expected in return, which is the tone the issue asks for.

🧪 How to test

The workflow cannot run from a fork's pull request, so on this PR it is inert by design. To exercise it on a branch in the main repository:

1. Set CONTRIBUTOR_SURVEY_URL and COMMUNITY_URL under Settings → Secrets and variables → Actions → Variables (or leave them unset to see the trimmed message).
2. Merge a pull request from an account with no previously merged pull request here. A single comment appears on it.
3. Merge a second one from the same account. Nothing is posted.
4. Close a pull request without merging. Nothing is posted, and nothing runs for a bot author.

Locally I validated the file parses and that the on, top-level permissions and job permissions blocks are exactly as above; I could not run actionlint on this machine.

⚙️ API / Back‑end changes

Not applicable — one workflow and a docs section.

✅ Checklist

• I have read and followed the contribution guide.
• Commit is signed off (DCO) and follows Conventional Commits.
• Action pinned to a full commit SHA.
• Minimal permissions; no checkout, no execution of pull request content.
• External URLs come from configuration variables.
• CONTRIBUTING.md documents the note and that the survey is optional.

🤖 AI (if applicable)

• The content of this PR was partially or fully generated using AI

[welcome]

Thanks for opening your first pull request in this repository! ✌️

[YvesCesar]

I'll review this

[YvesCesar]

Thanks for the contribution! :)

I raised a few points for discussion.

[vitormattos]

Look the previous comments, only changing the status to "request changes".

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.
see 221 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vitormattos]

Thanks a lot @dchaudhari7177 !
We now need to create the survey form first to have the URL and after this we will merge this PR.