Many projects have a list of contributors, either as a platform-agnostic AUTHORS text file, or in some way included in the project description metadata of the programming framework in use. When should users be added to that list, and who should add them?
Possible solutions that come to my mind or that I've heard or read in the past:
Anyone contributing code should be listed, i.e. the moment the pull request gets merged the one initiating the merge should ensure that the contributor gets mentioned. If the contributor thought of doing this already, that's all for the better.
Contributors who want to be named should add themselves as part of the pull request. If they don't it's their problem, and not much of a problem at that. If they later request being added, that request has to be honored.
The list of contributors should contain the core authors only, those responsible for the overall direction of the project. It's up to those core authors to decide when to admit some frequent contributor or new designated maintainer to their ranks.
It doesn't matter; in the days of GitHub, any such information as part of the working directory content is superseded by the git history anyway, and therefore should be ignored, or perhaps even deleted.
There certainly is a spectrum here, and certainly different projects will want to handle things differently. But are there any established guidelines applicable to many projects? Are there any legal requirements for or against one of these approaches? Any moral arguments to rule out one of them?
I think it matters, and everyone should be listed, and I think the reasons are almost entirely moral.
Limiting the list to the core team fails to acknowledge major contributors. Leaving contributors out because their contributions are small or infrequent is rude. After all, a contributor list is a form of 'Thank you' and perhaps offers a little encouragement to those who have not yet contributed. Maintaining a correct contributor list shows that you care about everyone's contributions.
Contributors who provide patches will have their email listed automatically in the history, otherwise I think simply their name/handle should be used.
The list should be automatically generated in the order of contribution. It motivates people to contribute more. Moreover people need not to add their name in last of list (general tendency). There are some tools who does that. However I prefer opencollective style to fetch and display contributors automatically.
Sometimes I prefer to separate maintainers / authors. So that visitors know whom to contact first specially to report vulnerabilities as it should not be public.