crowi-pr-received

Use gh pr view and gh pr diff to review the remote diff without checking out the contributor's branch. Classify the PR into categories like spam, deps, docs, bugfix, or feature, then draft a response for maintainer approval before any outbound action.

Query the author's cross-repository activity with the GitHub search API for recent PRs. Signals include identical PR titles spread across many repositories, no prior issue or discussion, and an account whose only activity is distributing such PRs.

Install scripts, test runners, and build configs all execute repository code, so running them on unreviewed changes can execute malicious payloads. Lockfile changes can also redirect resolved package URLs to hostile tarballs, a technique called lockfile poisoning.

No. Workflow changes are a classic path for stealing CI secrets, so they should never be merged from external contributors regardless of category. If the underlying idea has value, maintainers should reimplement the workflow themselves.

Accept only when there is evidence of real user demand and a contributor committed to maintaining the locale long-term. A locale without an active maintainer decays as new strings are added, so a conditional-accept response with a roughly two-week response window is the default.

Treat it as public disclosure and redirect the reporter to private vulnerability reporting such as GitHub Security Advisories, then close the PR. Implement the fix internally, credit the reporter, and scrutinize the diff carefully since fake security fixes can hide backdoors.