i do a lighter version on a small repo.
first-time contributors get a "what problem were you hitting?" question before i look at the diff. genuine ones answer in two sentences. the spam PRs either go silent or paste back something that doesn't match their own changes and too long. even those with em dash terminator are still easy to spot. it costs 30 seconds and filters almost everything.
a proper profile is also a must. i mean, we can all spot fake facebook pages. i believe we can spot auto generated github profiles.
and if their bot is actually good? why not? fix
web of trust is already quietly back, just informal. the PRs i actually merge now come from people i know from discord or a mutual. cold drive-by contributions went to near-zero acceptance. same thing happened to hiring at the same time, same mechanism: the open funnel stopped carrying information so we rebuilt the referral network.
on the same note though, if i would like to create a software vision with all designed architecture and tickets, i wouldn't mind public contributions. why not? helping each other.