Limit drive-by pull requests on an open source repo

How do I limit drive-by pull requests on my open source repo now

Use the repo settings first, not social pressure. Protect the default branch, require pull request reviews before merging, and add CODEOWNERS where review ownership matters. On GitHub, protected branches can require approving reviews, status checks, and code owner approval before merge.

Start by making the merge path narrow. If you protect only main or master, you still allow experimentation on branches, but you stop casual merges into the branch that carries your release line. GitHub documents that protected branches are available on public repositories and can enforce review and status requirements.

Add CODEOWNERS for the paths that need real knowledge. GitHub requests code owner review automatically when a pull request changes owned files, and GitLab uses Code Owners together with protected branches and approval rules to require expert review. That keeps random edits from landing without someone who knows the area seeing them.

Write a CONTRIBUTING file that changes where the first conversation happens. Ask people to open an issue before a pull request unless they are fixing a typo, a small docs bug, or a change you already scoped. GitHub’s template system supports pull request templates and issue templates, which makes that path visible instead of implied.

Make the template do work. Ask for the problem, the affected files, the reason the change belongs in the repo, and proof that the author read the existing issue or roadmap. A short template filters out drive-by submissions because people who want a quick merge usually do not answer specific questions. GitHub explicitly supports pull request templates for this purpose.

Put a review gate on unfamiliar contributors. On GitHub, required reviews before merging force approval from people with write access or a code owner, depending on how you configure the rule. That does not stop submissions, but it stops unvetted changes from moving forward on their own.

Use the branch rule to match your tolerance for noise. If you want fewer drive-by pull requests merged, require at least one approving review and keep stale approvals dismissed when new commits arrive. GitHub documents that stale approvals can be dismissed on new pushes, and that code owner approval can be required on protected branches.

The part people get wrong is trying to block strangers too early. Disabling pull requests outright or making the repo look hostile usually just shifts the problem elsewhere. GitHub says you can restrict pull request access or disable it entirely, but it also points people to support if abuse is the reason, which is a sign that wholesale shutdown is a blunt tool.

The better move is to separate access from acceptance. Let anyone open a pull request if that is useful for visibility, but make merging depend on review, ownership, and branch protections. That gives you a public inbox without making your default branch a free-for-all. GitHub and GitLab both document approval gates for this workflow.

If your repo gets a lot of low-effort edits, reduce the surface area that accepts them. Move unstable areas behind a small number of maintained directories, then assign those directories to CODEOWNERS. The fewer files a drive-by change can touch without review, the less attractive that path becomes. GitHub and GitLab both support path-based ownership.

Use labels and issue templates to move unknown work out of pull requests. A contributor can still propose an idea, but an issue gives you a chance to decide whether it belongs in the repo before someone spends time on code. GitHub’s issue template workflow is built for this kind of triage.

Keep your response consistent. If you reject a pull request, point to the same rules every time: no prior issue, missing template fields, wrong area, no maintainer signoff, or no code owner for the path. Consistency matters because drive-by contributors test the edges, and a vague rejection invites another attempt with slightly different packaging. This is an operational choice, not a community slogan.

If you use GitLab, the equivalent stack is approval rules, protected target branches, and Code Owners. GitLab documents that approval rules can require any number of approvals, that protected branches can enforce code owner approval, and that merge request approvals can be scoped by path or team. The mechanism is different, the control point is the same.

Be clear about what this does not solve. A strong review gate lowers noise, but it does not replace maintainer attention. Someone still has to triage issues, close out stale branches, and decide when a small outside contribution is worth accepting. The inconvenient part is that filtering drive-by work shifts effort from merging to judgment, and that is usually the real job.

A practical setup for most open source repos is simple. Protect the default branch, require one approval, require code owner review for sensitive paths, add a pull request template, add an issue template, and state in CONTRIBUTING that substantial changes start as issues. If you also want a place to route contributors who are serious about helping, point them to a workflow like DevConnect, where testing is reciprocal and stays on owned property. https://devconnectplatform.com

If you want the shortest version: make merging harder, not contributing harder. That keeps the repo open, but it stops the default branch from becoming a dumping ground for unreviewed pull requests. GitHub and GitLab both support that structure directly.

FAQ

Can I completely disable pull requests? Yes, but that is a blunt choice. GitHub documents repository settings for disabling pull requests, and it notes that support can help when abuse from strangers is the reason. If you still want outside contributions, branch protection plus review rules is usually the better fit.

Will CODEOWNERS stop every drive-by change? No. It requests the right reviewers and can require their approval on protected branches, but it does not decide whether the change is worth taking. People can still open low-quality pull requests, and maintainers still have to close them.

Should I ask contributors to open an issue first? Yes for substantial work, because it moves the conversation earlier and filters out random implementation-first submissions. GitHub’s issue and pull request templates are the right place to make that rule visible. Small fixes can stay exempt if you want to keep friction low for obvious patches.

What is the single most effective setting? Protected branches with required reviews. That setting blocks unreviewed merges into your main line, which is where drive-by pull requests cause damage. CODEOWNERS and templates improve the signal, but branch protection is the gate.

Do GitLab and GitHub handle this the same way? They use different names, but the pattern is the same: protected branches, required approvals, and path-based ownership. GitLab adds approval rules and policies; GitHub uses branch protection and CODEOWNERS. Both let you keep the repo open while tightening merge control.

How do I keep good contributors from getting stuck behind the gate? Make the rules specific and predictable. Tell people which changes need an issue, which files trigger code owner review, and which branch is protected. When contributors can see the path, the gate feels like process instead of rejection.