GitHub
The mezein GitHub App puts a check and a label on pull requests: is the author a real person? Contributors confirm once. Your project never learns who they are.
Set up
- Install the app from app.mezein.com/github on your organisation or account, for all repositories or just some.
- Finish on mezein: GitHub sends you to a setup page (mezein checks with GitHub that you manage the installation). Give a contact email and keep your dashboard key.
- Make it required (optional): in a repository's Settings → Rules (or Branches), require the status check
mezein: verified person. Pull requests then can't be merged until their author is verified.
On every pull request
| Author verified | Check passes. Label mezein: verified. |
|---|---|
| Not verified yet | Check waits (“Verify you're a person”), label mezein: waiting, and one comment with a link. Once they verify, the check and label turn to verified. |
| Reported or blocked | Check fails (“Can't verify here”). The verified label comes off. |
| Members, collaborators, bots | Check is skipped (neutral). No label, no comment. |
Filter by label in your pull request list, or search is:pr label:"mezein: verified".
For contributors
They click Verify with mezein in the comment or check, sign in with GitHub (only so mezein knows which account it is; nothing else is read or kept), and confirm with their pin. One GitHub account per person for each project. Without a pin, the page tells them how to get one.
Reporting
- Add the
mezein: reportlabel to their pull request. The app puts this label in your repository for you. The report goes in straight away, and the check turns red. - Block them from your organisation. That reports them too.
Either way they can't verify for your project again. Only accounts that verified with your project can be reported this way. See Reporting.
Good practice
- Make the check required on repositories that get a lot of drive-by pull requests; leave it advisory elsewhere.
- If you keep your organisation membership private, GitHub may not tell mezein you're a member, and your own pull requests can be treated as outside ones. Making membership public fixes that.
- Report generated spam rather than just closing it, so it gets caught on other projects too.