We stopped AI bot spam in our GitHub repo using Git's

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#251

Post by TuxSH » Wed, May 20, 2026, 3:16 PM UTC

halapro wrote: post #242

karussell wrote: post #191

Earlier quoted context omitted.

This. But OP wanted special requirements to open a PR. I.e. if those requirements are not met the PR is never visible to all and so admins can reject spam PRs without giving them a platform.

We occasionally get traditional SPAM PRs pointing to their product. In that case it is very useful to clear out title, PR body and reset the commits as well, so none of that appears on the repo. This is time consuming. Unfortunately the PR and the PR author will forever be listed there and linking to their product anyway.

> Unfortunately the PR and the PR author will forever be listed there

If they've been doing that to the other repo (and especially if they're just a spam account), there's a good chance using the "report" button and/or contacting GH support directly can yield positive results, up to the spam account being deleted (and the PR is usually deleted).

Unfortunately this doesn't scale.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#252

Post by simgoh » Wed, May 20, 2026, 5:56 PM UTC

cermicelli wrote: post #42

ildari wrote: post #23

Earlier quoted context omitted.

fair point! We believe "Require approval for all external contributors" should be a default setting, as you cannot trust anyone who is not a member of the organization

you can't trust org members either I have seen projects have inter maintainer fallouts. In general trust doesn't exist. If companies can screw you over and claim it's a mistake, there isn't much a person can do. It's all about level's of trust, a maintainer going rogue is less likely, a past contributor going rogue more likely but not too much, a stranger with a typo pr merged even more likely but still, a complete s…

You also can't fully trust org members because valid / "Trusted" accounts can be taken over by nefarious actors as well.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#253

Post by riponcm » Thu, May 21, 2026, 12:50 AM UTC

icelancer wrote: post #218

riponcm wrote: post #216

Earlier quoted context omitted.

could you explain please?

repo is cloned, AGENTS.md is auto-read into context, the doc says to not allow PR spam. think of it like a soft prompt hook.

[dead]

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#254

Post by halapro » Thu, May 21, 2026, 1:19 PM UTC

TuxSH wrote: post #251

halapro wrote: post #242

Earlier quoted context omitted.

We occasionally get traditional SPAM PRs pointing to their product. In that case it is very useful to clear out title, PR body and reset the commits as well, so none of that appears on the repo. This is time consuming. Unfortunately the PR and the PR author will forever be listed there and linking to their product anyway.

> Unfortunately the PR and the PR author will forever be listed there If they've been doing that to the other repo (and especially if they're just a spam account), there's a good chance using the "report" button and/or contacting GH support directly can yield positive results, up to the spam account being deleted (and the PR is usually deleted). Unfortunately this doesn't scale.

> Unfortunately this doesn't scale

Correct. I used to report them, but 3/4 years ago they made it more difficult to report anything because you have to explain what's wrong even when it's very clear.