How to Manage AI-Generated Code in Strict Open Source Projects

The challenge of strict AI policies

Oracle recently prohibited AI-generated code from being included in the OpenJDK distribution. If you contribute to or maintain high-stakes open-source projects, you need a strategy to ensure no AI-generated fragments slip into your final source files.

In this article, you'll learn:

• How to build a simple detector for common AI markers.
• How to integrate that detector into your CI pipeline.
• How to balance automated checks with manual code reviews.
• The common pitfalls that lead to false positives and negatives.

Understanding the policy

Oracle's rule is specific: any code produced by an AI model that ends up in the official JDK release must be removed. This isn't a ban on using AI as a drafting tool or a brainstorming partner.

You can use an LLM (Large Language Model) to help you think through a complex algorithm, but the final code that lands in the repository must be written by a human. The policy targets the source files themselves, meaning any identifiable fragments from an AI must be scrubbed before the merge.

Detecting AI-generated markers

One of the easiest ways to catch accidental leaks is to scan for common markers. Many developers copy code directly from a chat interface, often bringing along comments like "Generated by ChatGPT" or similar headers.

I wrote this Python script to scan a directory for these specific strings. It's a lightweight way to catch the most obvious mistakes before they reach a reviewer.

import os
import re

## Common strings left behind by various AI assistants

AI_MARKERS = [
    r"Generated by ChatGPT",
    r"Generated by OpenAI",
    r"Generated by Gemini",
    r"AI-generated code",
]

## Compile the pattern once for efficiency

pattern = re.compile("|".join(AI_MARKERS), re.IGNORECASE)

def scan_directory(directory_path):
    for root, _, files in os.walk(directory_path):
        for file in files:
            if file.endswith(".java"):
                full_path = os.path.join(root, file)
                with open(full_path, "r", encoding="utf-8") as f:
                    if pattern.search(f.read()):
                        print(f"AI marker found: {full_path}")
                        return True
    return False

if __name__ == "__main__":
    if scan_directory("src"):
        exit(1)  # Exit with error code for CI
    exit(0)

This script uses the re module to perform a case-insensitive search. I've added an exit code logic so it can be used effectively in automated environments.

Integrating detection into CI

Running a script manually is fine for a local check, but you need automation to enforce a policy. You can add a step to your GitHub Actions workflow to block any Pull Request (PR) that contains these markers.

Here is a minimal configuration for a GitHub Actions workflow:

name: AI Content Guard

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  ai-check:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Run AI detector
        run: |
          # We run the script and let it exit with code 1 if markers are found
          python detect_ai_code.py

By setting continue-on-error: false (which is the default), the entire build will fail if the script finds a marker. This prevents the code from being merged into your main branch.

Balancing automation and manual review

Automation is great for catching the "low-hanging fruit," but it isn't perfect. A sophisticated developer might prompt an AI to "write code without comments," which bypasses your script entirely.

You need a hybrid approach. Use automation for speed and manual review for depth.

Approach	Strength	Weakness	When to Use
Marker Scan	Fast and zero-cost	Misses unmarked code	Early CI guard
Manual Review	Detects subtle patterns	Time-consuming	Final gate
AI Detection Tools	Finds complex patterns	Requires maintenance	Large codebases

A manual review checklist

When you are performing a final review on a sensitive PR, keep these questions in mind:

• Does the code style match the rest of the project perfectly?
• Are there any strange TODO comments that look like AI-generated placeholders?
• Does the logic follow a pattern that feels slightly "off" or overly verbose?
• Did the author rewrite the logic after the initial implementation?

Only mark a PR as AI-free once you are confident the code is original human work.

Common failure modes

Even with these steps, things can go wrong. You should be aware of these three common issues:

• False positives: A developer might write a comment like "This was inspired by a ChatGPT conversation," which triggers the script even though the code is original.
• False negatives: This is the biggest risk. If the AI code is clean of markers, your automated check will pass, leaving the responsibility entirely on the human reviewer.
• License conflicts: Some AI models include specific license headers in their output. You must ensure that no such headers are accidentally merged into your project.

Key Takeaways

• Oracle's policy targets the final source files, not the developer's workflow.
• A simple Python script can catch the most common copy-paste errors.
• CI integration is the best way to enforce compliance automatically.
• Manual review is the only way to catch sophisticated AI-generated code.

Source

Oracle bans AI-generated code from OpenJDK — I added detection scripts, CI integration, and a trade-off table not covered in the original.