Stop AI Bot Spam on GitHub Using Git's --author Flag

GitHub repositories are facing a new scale of automated noise. Projects like DBeaver recently reported thousands of AI-generated discussions and comments appearing daily—a volume that overwhelms standard manual moderation and the platform's native reporting tools. When bots can generate context-aware spam faster than maintainers can click 'Block', you need a structural defense that shifts the burden of proof back to the contributor.

Maintaining an open-source project shouldn't mean managing a low-quality AI data stream. By combining GitHub's native interaction gates with Git’s --author metadata, you can create a high-friction environment for bots that remains navigable for legitimate humans.

The Mechanism: Prior-Contributor Gating

The core problem for repos like DBeaver is that GitHub's default state is 'open to all'. Anyone with an email-verified account can post. To stop AI spam, you must flip this logic: restrict interactions to users who have already successfully merged a commit.

However, this creates a 'cold start' problem: how does a legitimate first-time contributor get that first commit merged if they are blocked from opening a PR?

The Archestra Protocol

Archestra solved this by moving the screening process outside of GitHub’s standard UI. Their workflow follows a specific sequence to validate contributors before they are granted repository permissions:

1. The Screening Portal: Newcomers are directed to an external form protected by a robust CAPTCHA.
2. Identity Verification: The user provides their GitHub handle and email.
3. Automated Commit: Once the CAPTCHA is cleared, an automated internal process creates a small, benign commit (like adding the user's name to a CONTRIBUTORS.md file) to a dedicated branch.
4. Authorship Injection: The system uses the git commit --author="Name <email>" flag to attribute the commit to the new user, even though the system's bot is technically performing the write operation.
5. The Gate Opens: Once this 'authored' commit is merged, GitHub recognizes the user as a 'prior contributor', allowing them to bypass interaction limits and open PRs or Issues normally.

Implementation: Using the --author Flag

Git distinguishes between the committer (the person who runs the command) and the author (the person who wrote the code). In an automated screening flow, your automation server acts as the committer, but you must specify the user as the author to satisfy GitHub's internal logic.

# Example: Creating a verification commit for a screened user

git commit -m "docs: verify contributor @jdoe" --author="John Doe <jdoe@example.com>"

To audit your history and find commits that might have bypassed your gates or were added by unknown actors, use the filtering flag with git log:

# Find all commits not authored by your verified team members

git log --author="PatternToMatch"

Cleaning Up Bot Leaks

If spam commits do land in your history, you cannot simply delete them; you must purge them from the reflog to maintain a clean audit trail. Video documentation suggests using git rebase for small-scale cleanups or git filter-branch (or the more modern git-filter-repo) to scrub specific authors from the entire project history.

# Use filter-branch to remove commits from a specific spammy author

git filter-branch --commit-filter '
    if [ "$GIT_AUTHOR_NAME" = "SpamBot123" ];
    then
            skip_commit "$@";
    else
            git commit-tree "$@";
    fi' HEAD

Comparison: Defense Strategies

Architectural Considerations

While this approach effectively kills automated spam, it shifts the burden forward. Maintainers must ensure the screening portal is highly available. If the form or the CAPTCHA service goes down, your repository effectively becomes 'read-only' for the entire world.

Furthermore, while GitHub organizations can now delete posts when blocking a user, that user can still operate elsewhere on the platform. The goal of the --author gateway isn't to fix GitHub's global spam problem—it's to create a 'walled garden' for your specific project so you can focus on code rather than moderation.

If you're managing a growing project and the manual overhead of bot moderation is stalling your roadmap, it's time to automate your gates. At AImatic, we build custom automation workflows that secure your development cycle without killing your velocity. Reach out at hello@aimatic.dev to discuss hardening your repo.