Proposal: Detect Hacktoberfest PRs without requiring commit sign-off

pascalberger commented 4 years ago

Expected Behaviour

Possibility to check for Hacktoberfest spam PRs without requiring signed off commits

Current Behaviour

hacktoberfest feature requires commits to be signed-off.

Possible Solution

Split check for commit sign-off into a separate feature.

Steps to Reproduce (for bugs)

Use a repository where commit sign-off is not required
Create a PR as first-time contributor updating some Markdown files without commit sign-off

Context

We added Derek to the https://github.com/cake-build/website repository which was flooded by Hacktoberfest spam PRs. The pr_description_required feature already helps. We can't use the hacktoberfest feature at the moment because we don't require commit sign-off.

Your Environment

[x] You're using the hosted Derek service

or

[ ] You host your own OpenFaaS cluster with Derek installed

Docker version docker version (e.g. Docker 17.0.05 ):
Are you using Docker Swarm or Kubernetes (FaaS-netes)?
Operating System and version (e.g. Linux, Windows, MacOS):

alexellis commented 4 years ago

Can you suggest an alternative detection mechanism that would work for you?

I'm glad that the empty PR description is useful, what other kind of checks night be helpful to you?

pascalberger commented 4 years ago

@alexellis Thanks for getting back so fast 👍

Currently we're mainly struggling with Hacktoberfest spam. So anything which would automatically close these issues would be great.

I think the current mechanism for hacktoberfest without the signed-off check would work for us:

First time contributor
Only Markdown file changed
No description in the PR seems to also be a common thing in current spam PRs

alexellis commented 4 years ago

What do you think of #164? We are testing it here:

https://github.com/openfaas/org-tester/pull/33

Existing committer: https://github.com/openfaas/org-tester/pull/34

pascalberger commented 4 years ago

What we did in the meantime was enabling interaction limits (first for recently created accounts, then for people without prior contributions). #164 sounds feature wise similar, but with the advantage that people still can submit legitimate PRs. So would be an improvement to lock repo completely

alexellis commented 4 years ago

It's merged and available for all users. Just add no_newbies to your Derek feature list.

Would you also mind pinging an email to alex@openfaas.com to connect?

Alex

alexellis commented 4 years ago

Example of no_newbies:

https://github.com/openfaas/org-tester/pull/39

I was thinking of adding a min account creation date, but for your PRs - they are not actually from bots (I checked) they are from people with largely inactive but pre-existing accounts.

rgee0 commented 2 years ago

Derek close: functionality added with the no_newbies feature

alexellis / derek