Hashcash: https://en.wikipedia.org/wiki/Hashcash

CAPTCHA: https://en.wikipedia.org/wiki/CAPTCHA

Proof of intelligence might be better.

Resurrecting proof-of-work for pull requests just trades spam for compute and turns open source into a contest to see who can rent the most cloud CPU.

A more useful approach is verifiable signals: require GPG-signed commits or mandate a CI job that produces a reproducible build and signs the artifact via GitHub Actions or a pre-receive hook before the PR can be merged. Making verification mandatory will cut bot noise, but it adds operational cost in key management and onboarding, and pure hashcash-style proofs only push attackers to cheap cloud farms while making honest contributors miserable.

The signal-to-noise ratio on PRs has definitely tanked since everyone started hooking up basic LLM scripts to their repos. Discarding the low-effort ones is a good first step, but the long-term solution is evaluating PRs structurally against historical incidents and performance impact. At CloudThinker, we focused our AI code review engine purely on this deep, incident-aware context—catching vulnerabilities and regressions automatically so human reviewers only spend time on architecture.

As if we need wasting even more power