How to stop pull request spam on an open source repo

Description and use

Implementing branch protection, required reviews, CODEOWNERS, and a contributor funnel reduces spam pull requests while keeping the repository open to genuine contributors.

Problem

Open source repositories often receive spam pull requests that consume maintainers’ time and clutter the merge queue.

Outcome

Implementing branch protection, required reviews, CODEOWNERS, and a contributor funnel significantly reduces spam pull requests while keeping the repository open to genuine contributors.

Workflow

• 1. Protect the main branch (e.g., main or master).
• 2. Require passing CI checks and at least one approving review before merge.
• 3. Add CODEOWNERS for sensitive files to auto‑assign reviewers.
• 4. Create issue and pull‑request templates that ask for motivation, reproduction steps, and screenshots.
• 5. For first‑time contributors, require opening an issue or discussion before a pull request.
• 6. Close spam pull requests quickly with a brief explanation and link to CONTRIBUTING.md.
• 7. Restrict write access to a minimal set of trusted maintainers.
• 8. If abuse persists, consider disabling pull requests for strangers.

Evidence

Lock the merge path, gate first‑time contributors, and route strangers to issues or discussions first.

Source

Require passing checks and at least one approving review before merge.

Source

Add CODEOWNERS for the files that attract drive‑by changes.

Source