The day is still young. But in #curl we already had...

Weirdo one: adds 7 comments to the first #curl commit on GitHub. The comments look like maybe a file listing of files that existed in that first git commit?

Banned.

Weirdo two: creates a new issue from a short (seemingly random) comment someone did in an ongoing open PR. Adding nothing new.

Banned.

Both cases completely inexplicable and weird.

@bagder Someone is testing their spam bots?

AI slop?

@bagder

@BradRubenstein slop usually looks better than this, but who knows!

@bagder aliens trying to learn how to github?

Or maybe someone gave an AI methods for interacting with github without explaining to it what github is?

@bagder I've had one person that was just pouring their mind out to issues in the Mastodon Android app repo. It was a weekly occurrence. There were some nonsensical feature requests, sometimes not even for the app itself but for the platform as a whole. We gave them several warnings, but that didn't work, so we banned them.

@bagder They are hoping that those get merged and then they can claim they are contributors to #curl.

Probably out there doing that to dozens or hundreds of other well known and lesser known repos.

@bplein they weren't pull requests, there was nothing to merge...

@bagder more often than not, weird interactions like those are people probing for injection in the CI to steal tokens.
A good indicator is if the comment has been edited.

@vincentbiret how are comments or new issues able to probe anything like that? You probably think of PRs, but these weren't.

@bagder After my coffee, I now see that’s what you said. ☕️

Strange indeed.

@bagder if you're using those "fields" in workflows to do things like automatically add labels, generate changelogs, etc...
The trick is to make sure you always use intermediate environment variables and NEVER directly use the value in scripts. Doing so, automatic escaping will be done for you.

@vincentbiret these did not run any workflows

@bagder

> completely inexplicable and weird.

On-brand for 2025, apparently.