[Repository] Limit/prevent spam issues/PRs

[GuillaumeDua]

Motivation

• Limit/constraint the amount of new irrelevant issues and PRs
• Thus avoid unnecessary notifications and emails received by the ~2k watchers of this repository
• Yet ensure the solution won't be an impediment for legit contributors

Context

Roughly checking on:

• Closed-as-not-planned issues
• Unmerged PRs

Some recurring characteristics emerge:

• The account user was just created
• Short issue/PR name: most likely, a single word
  • contributor name, possibly shortened
  • generic ("Git", "practice", "projects", "Cpp", "ccc", "Hello World", "Hi", "Halo", etc.)
• Short issue/PR body
• The issue/PR is the first one of this user, ever.
• There's no previous nor further activity on the user's account.

And sometimes:

• The contributor name is composed like <some_indian_name>_?\d+, but this cannot constitute a criterion in any way.

Suggested solutions

Turn on moderation settings

• See interaction limits, to enable Limit to existing users

Disable blank issue/PR template

From my perspective, a (bunch of) dedicated template issue/PRs with many non-empty fields are a good way to avoid unnecessary issues and/or PRs.

Add a dedicated anti-spam github-action

Such a github-action would perform several checks, as acceptance criteria.

Technically it could rely on actions/github-script@v7 (and octokit) to use the github rest API.

The repo's example here automatically add a comment to PR created by new contributors.

We can then implement other criterions, as the one listed in the Context section above.

What if the checks does not pass ?

• Either add a dedicated label suspicious to the issue or PR.
• Or immediately rejects the issue/PR by closing it,
  possibly adding an automated comment describing the reason, and pointing to the "how to contribute" guideline.

Additional thoughts

• Either solution might make the spammers always find new ways to meet such acceptance criterias and keep on spamming, over and over again ?

[jwakely]

It would be great if we can stop nonsense like #2257, #2241, #2254, #2252, #2249, #2238, #2225 etc. etc. etc.

[GuillaumeDua]

I made some experiments, available with the draft PR #2259 (disclaimer, I'm not a JS developer).

• Ok example: all checks pass
• Rejected example: 1 check failed, others pass

From that point, I think we need to:

• Consider using first the non-CI options mentioned above
• Be really clear on the acceptance criteria must be, so we don't imped legit users.

From my perspective, either suggested solution would prevent nonsenses like #2255 .

[GuillaumeDua]

Bump 😉, as #2283 .

Using authors public informations available on github,
theory then is that this repo is mentioned in some training of universities, located in India, delivering a master in computer science :

• Chitkara University, Punjab, India
• Gauhati University, Guwahati, Assam, India

3 options then:

• Consider non-CI options, as mentioned above in the Suggested solutions section 🙏
• Consider a CI option, but we need some guideline
• We can contact such issue authors to gather more infos.

[jwakely]

We could also just contact the universities and tell them to educate their students properly so they don't create nonsense tickets here.

[GuillaumeDua]

Agree. Who do you encompass as "We" ? Shall I do it ?

[jwakely]

If you want to, otherwise I can do it late next week

[BenjamenMeyer]

We could also just contact the universities and tell them to educate their students properly so they don't create nonsense tickets here.

They'd have to educate the professors too. I think too many of these are universities in China/India where a professor tells them to contribute to open source so they go and create a PR/Issue on something popular to fulfill the assignment.

[GuillaumeDua]

@BenjamenMeyer Totally agree. However, It sounds quite an unrealistic thing to do right now, that's why I created this issue so we can dig into technical solutions.

@jwakely Sure thing, I'll do it and update this issue if I get any feedback.

[GuillaumeDua]

@jwakely Done.
Disclaimer: I used ChatGPT to produce a formal, professional email which focuses on education rather than blame, while making clear the problem and its impact.

The email was sent to 3 universities + their local variants.

• Chitkara University
• Graphic Era Hill University
• Gauhati University

---

To whom it may concern,

I am writing on behalf of the C++ Core Guidelines project on GitHub, an active open-source initiative that welcomes constructive contributions from developers worldwide, including students.

Recently, our project has seen a significant increase in low-value or spam contributions, often in the form of pull requests or issues with empty or irrelevant titles and descriptions (e.g., “my first contribution to open-source”), or unrelated changes with no meaningful improvement to the project.

In many cases, we suspect such contributions to be created by students completing coursework assignments to “contribute to open source.” While we appreciate the intent to encourage students to engage with the open-source community, such submissions cause several problems:

They create noise that makes it harder for maintainers to address real issues and review genuine contributions.

• They produce spam notification emails to about 2000 active watchers

• They disrupt ongoing technical work and delay legitimate changes.

• They risk harming the reputation of the student and the university in the global developer community.

We respectfully request your assistance in educating students and faculty on the importance of making meaningful, relevant, and respectful contributions to open-source projects. For example:

• Before creating an issue or pull request, students should read the project’s contribution guidelines and code of conduct.

• Contributions should address a real problem, bug, or enhancement relevant to the project.

• Provide clear, detailed explanations in titles and descriptions.

• For practice assignments, consider creating internal or sandbox repositories, rather than submitting to unrelated projects.

Open source thrives on collaboration, mutual respect, and purposeful work. By preparing students to participate meaningfully, we can ensure a positive experience for them and for the projects they engage with.

We appreciate your understanding and cooperation in this matter, and we welcome any questions or discussions on how to better guide students toward valuable open-source participation.

Sincerely,

[GuillaumeDua]

FYI, none of the university replied to the email so far ... 🤷

[LegalizeAdulthood]

It seems they don't care, in which case IMO they should be blacklisted from submitting PRs

[jwakely]

It seems they don't care, in which case IMO they should be blacklisted from submitting PRs

How? The clowns opening dumb issues and PRs don't belong to some GitHub org, they're just users on this site. We don't have a list of their usernames.

[BenjamenMeyer]

It seems they don't care, in which case IMO they should be blacklisted from submitting PRs

How? The clowns opening dumb issues and PRs don't belong to some GitHub org, they're just users on this site. We don't have a list of their usernames.

And further, they accounts tend to be new accounts (<30 days) with this being their first/only PR/issue (#2285). @GuillaumeDua 's PR looks decent for checks that way.

FYI, none of the university replied to the email so far ... 🤷

Perhaps another method would be to start publicizing the issue in various media - LinkedIn, etc - to get wider attention- especially if we could hit some that were in the Academic circles - IEEE, ACM; ACM seems to have a sub-council for member activities there.