Proposal: Contributor reputation check workflow for spam/astroturf detection

[imran-siddique]

Context

Multiple AI agent and governance repos on GitHub have been targeted by coordinated inauthentic contribution campaigns:

• Accounts spray low-effort issues across 30+ repos in a few days
• Trivial PRs get merged, then cited as credentials in foundation proposals
• Product placement disguised as feature requests

We built detection tooling for this in microsoft/agent-governance-toolkit and have been using it on our own repo successfully.

Proposal

Add a lightweight GitHub Actions workflow that screens new PRs and issues for these patterns:

1. Profile check: Account age, follower ratio, repo patterns
2. Spray detection: Same user opening similar issues across many repos in a short window
3. Credential audit: Checks for merged-PR-to-citation pipelines

Results are posted as a comment + label on MEDIUM/HIGH risk items for maintainer review. No auto-closing, just flagging.

The workflow uses stdlib-only Python scripts (no pip install), runs on pull_request_target and issues events, and needs only the default GITHUB_TOKEN.

Why awesome-copilot specifically

This repo has 21,000+ stars and accepts community contributions (instructions, skills, prompts). That makes it a natural target for credential-building campaigns. The workflow would help maintainers spot patterns early.

Previous attempt

I submitted PR #1520 directly without discussing first. @aaronpowell rightly closed it and asked for discussion first. So here we are!

Happy to discuss scope, thresholds, or alternative approaches. The scripts are MIT-licensed and dependency-free.

[aaronpowell]

Thanks for the deeper info into the project and the thinking that motivated the creation of #1520. I've reopened that PR to review on it.

One observation I have on the format is that it is somewhat ambiguous in the report it adds as a comment. When looking at some of the runs on the agent-governance-toolkit repo, I find that the column Result is somewhat confusing because Result: High doesn't really tell much, is High good or bad?

Happy to raise an issue on the tool repo if that's useful feedback.

[imran-siddique]

Thanks for the deeper info into the project and the thinking that motivated the creation of #1520. I've reopened that PR to review on it.

One observation I have on the format is that it is somewhat ambiguous in the report it adds as a comment. When looking at some of the runs on the agent-governance-toolkit repo, I find that the column Result is somewhat confusing because Result: High doesn't really tell much, is High good or bad?

Happy to raise an issue on the tool repo if that's useful feedback.

No problems! Thank you please open an issue and I'll address in AGT. Let's work together to further bake this check.