If you aren't already familiar, you might dig Secure Scuttlebutt. Dat is also in a very similar space.
This is exactly right, and is one of the main reasons we still use GitHub for issue tracking. There's some internal Git + issues + npm registry infrastructure that some of us use, but it only works when other contributors are within your web of trust. It also depends on SSB working, which means that broken SSB installations can't report bugs (!).
The main implementation defaults to downloading content from people you follow and people that they follow, but this could (and should (in my opinion)) be increased once we've finished partial replication and off-chain content. I'd prefer to download a public message addressed that's 5 hops away over a private message from 4 hops away, but right now we don't have infrastructure to do that.
Potential friends that are connecting to the network for the first time and are experiencing bugs should probably have some public bug tracker that they can report to, but I'd imagine that once someone confirms your issue that it'd be moved from purgatory into the formal bug tracker.
Bias disclaimer: I'm very skeptical of GitHub-style issues, where anyone can add items to your todo list, and I'd really like to experiment with systems that require maintainer consent before an issue is hosted on the bug tracker.
Joining mailing lists and configuring your SMTP client not to mangle patches seems like an art that everyone just decided to forget how to do.
(As an ex-maintainer of the Linux kernel I'm aware that they still do it there. Just.. mostly no-one else.)
But also, behind the times in one important way. GitHub has created an expectation that anyone in the world can open an issue against and collaborate with a project. That's incompatible with requiring Git push access to make changes to issues.
I created another project -- GitTorrent -- which also tried to increase the decentralization of software production, and this tension of collaboration benefitting from centralized spam fighting and access control mechanisms was there, too.
Hopefully one day there'll be magic spam fighting blockchain decentralized identity dust that makes everything work with p2p.