isn’t the better solution not to accept PRs from unknown / untrusted sources
I think that’s partly the point of this exercise - if they find a meow they now know this is an untrusted source.
Because it’s pretty easy to say ‘ignore untrusted sources’ but when you’re maintaining an open source repo (especially if it’s still pretty small/new) this detection is part of the cognitive burden. Almost every contribution will technically be from an unknown source for a long time, until, if you’re lucky, some drive-by contributors turn regular.
I think that’s partly the point of this exercise - if they find a meow they now know this is an untrusted source.
Because it’s pretty easy to say ‘ignore untrusted sources’ but when you’re maintaining an open source repo (especially if it’s still pretty small/new) this detection is part of the cognitive burden. Almost every contribution will technically be from an unknown source for a long time, until, if you’re lucky, some drive-by contributors turn regular.