Everything about this is exactly what is happening in OWASP repos.

I pick the "block" option on the junk issue, and tick the "Send a user notification and show activity in timeline". The text says "A public timeline entry will show that this user was blocked" which I hope discourages them from wasting our time.

GitHub PM here. From what we've seen, you're right about the motivation; I've also seen plenty of job ads where "significant contribution to open source" is something that's called out explicitly as a valid substitute for professional experience in the area. While that's always well-intentioned and creates many benefits for the OSS community, the flip side is that it can also lead to the kind of problems you're seeing. Many new users are also motivated by learning and community, and not familiar enough with the community expectations to know how to seek that differently.

We have tried a lot here in the past (good first issues, more community support for new users), but haven't found a perfect solution yet. Internally, we're looking at options for admins to disable PRs on repos, or limit PRs to collaborators only, for example. From your comment, it seems like part of the challenge you're experiencing as a user is around Issues specifically. We've also been looking at options to delete PRs and Issues individually and in bulk, which could help after the event. Would welcome any feedback on other paths we could take here.

Make it possible to turn off PRs from new accounts, accounts with a low PR acceptance rate or accounts that create lots of PRs all at once in unrelated projects. Or mark those kinds of PRs in a visible special way. Or make those kinds of issues and PRs non-public so that maintainers can silently drop them without creating publicity for the slop-spammers.

It would help if PRs from newly-created or private accounts could stand out. And perhaps PRs from accounts that spam multiple PRs with dozes or hundreds of commits, would have some kind of a warning that only people with write access to repos can see. In fact perhaps GitHub could throttle those accounts from creating that many PRs in the first place.

Another suggestion would be trying to figure out if a PR was vibe-coded and marking them as such. Sames as image-based social media tries to do.

That makes a lot of sense, and we've been considering some of those options too so good to know we're on the right track there. On trying to figure out whether a PR was vibe-coded: in some cases it's obvious, but in many cases it's hard to figure that out without AI, and we're not sure we love a solution that requires maintainers to use AI to tackle AI. My hope is that if we can provide some non-AI tools first (disabling PRs, creating more visibility around new users, etc), we can then build better management and triage tools with AI second. We're working on an Issues triage agent now that we hope to bring over to PRs too.

I get a lot of unsolicited PRs on my projects that I don't actually want

Turning off PRs would be a good option for several of my repos

Great, we're on it

Thanks a lot for taking this seriously. I regularly contribute but am not a “maintainer” so can’t really turn off PRs or anything, nor do I think that’s the right thing in this case. But some signal to spot these accounts at a glance before I go through and try to repro their issue or spend time engaging would be cool. Or immediate signal on “new accounts” (on HN usernames are green for like 30 days), or “account age vs PR velocity” would be interesting to me. Old accounts with regular PRs or Issues are not a prob, but the new accounts that just spam low quality issues and PRs are maddening.

Yep, totally get this. We're going to try and provide some quick solves first for the most affected maintainers, and then go back and make sure we can also help with the kind of nuance you describe.

I think a "PR quality score" would go a long way here. Doesn't even have to be displayed to the user, you can just flag it as a low-quality PR under a certain threshold and have it go to a separate view for the maintainer. Have a prominent 1-click button to close it as low quality/spam with a default message about useless PRs. To go along with this you'd probably want a "report" button on comments/PRs to flag them as (spam/AI generated/useless change/etc.)

You could estimate quality with: number of PRs accepted before (only counting repos >2 years old), age of account, size of diff, number of PRs reported as spam.

Thank you for looking into this. It's a huge problem for maintainers these days... something needs to be done.

Maybe you a mysterious hidden ELO score that effectively shadow bans people if they get a negative report from a high ELO maintainer. Perhaps look at how dating apps do it as they have to deal with a many persistent undesirable people.

Or just throw up a money hurdle. The reason you're seeing so many hustle bros from poorer countries is simply because the cost of accessing the internet is now effectively zero.