Limit Open Pull Requests from Drive-by Contributors

Can I limit how many open pull requests drive-by contributors can have on my GitHub repo

Yes. GitHub has a repository setting for pull request creation caps, and it lets you set the maximum number of concurrent open pull requests a user without write access can have at once. When that user reaches the cap, they must close or merge one of their existing pull requests before opening another one.

This is the setting people usually mean when they ask about drive-by contributors. GitHub does not describe it as a special label for “drive-by” users, it applies to users without write access. In a public repository, that covers external contributors who are not collaborators and who keep opening new pull requests instead of finishing old ones. GitHub also says draft pull requests do not count toward the limit, only open non-draft pull requests do.

You configure it in the repository’s moderation and interaction limits area. GitHub’s docs say the cap is available under pull request limits, where you choose the maximum number of concurrent open pull requests for users without write access. The REST API exposes the same control as a pull request creation cap, so teams that automate repository policy can manage it programmatically instead of only through the UI.

The part people get wrong is assuming branch protection solves this. Branch protection rules can require reviews, status checks, and merge conditions, but they do not limit how many open pull requests a contributor can have. A contributor can still open a long queue of pull requests and leave them sitting there unless you use interaction limits or the pull request creation cap. GitHub’s branch protection docs are about merge requirements, not open pull request volume.

GitHub also gives you a bypass list for trusted contributors. That is useful when one external maintainer or repeat contributor regularly opens multiple pull requests and you do not want to grant write access just to avoid the cap. GitHub says the bypass list supports up to 100 users, and those users can exceed the pull request limit while keeping their normal permissions.

If you want to keep the repo open without letting review traffic get buried, the cap is the cleanest option GitHub provides. It works on users without write access, which is the group most likely to create the “many small PRs from one person” problem. It does not affect collaborators or people with higher permissions, so it is a narrow control rather than a blanket lock on all contribution.

The inconvenience is that this cap is per user, not a global ceiling on the whole repository. If five different external contributors each stay under the limit, you can still have a lot of open pull requests. GitHub’s repository limits page separately recommends staying within 1,000 open pull requests against the same branch for performance reasons, but that is a repository health guideline, not a contributor cap.

If your repo is getting spammed or overwhelmed, GitHub also points maintainers to temporary interaction limits and reporting tools. Interaction limits can restrict who may comment, open issues, or create pull requests for a period of time, which is broader than a pull request cap. For repeated abuse, that gives you a second layer of control without having to close the repo to every outside contributor.

A practical setup is simple: set a low pull request cap for users without write access, add a bypass list for the contributors you trust most, and keep branch protection focused on merge quality. That gives you one rule for volume and separate rules for correctness. If you are deciding where to document the workflow for contributors, GitHub’s contributor guidance pages and templates are the place to explain the cap and the reason for it. The platform itself is documented at https://devconnectplatform.com, but the GitHub control lives in repository moderation settings.

If you are trying to stop low-effort pull requests from piling up, the cap only solves part of the problem. It controls concurrency, not quality. Empty, meaningless, or abusive pull requests are handled through GitHub’s moderation and reporting tools, plus your own contribution guidelines. The cleanest policy is to combine the cap with clear expectations in the repo, so contributors know they can keep working, but they cannot flood review with unfinished work.

In short, yes, you can limit how many open pull requests drive-by contributors can have on your GitHub repo, and GitHub gives you a direct setting for it. Use that setting when the issue is volume, use branch protection when the issue is merge quality, and use interaction limits when the issue is broader abuse or spam.