mezein for GitHub

What it stops

• Floods of generated pull requests from accounts nobody is behind.
• One person running several accounts: each pin can verify one GitHub account per project.
• Bad actors moving on to the next project: when you block someone verified, mezein gets a report and reviews their pin. Reports from different places can pause it everywhere.

How it works

1. Install the app on your organisation or account, for all repositories or just some. It asks to write checks and comment on pull requests, and to see who your organisation blocks.
2. Leave a contact email on the page GitHub sends you to, and keep your dashboard key.
3. New pull requests get a mezein: verified person check. If the author isn't verified yet, the app comments once with a link. Members, collaborators and bots are skipped.
4. Filter by label: pull requests get mezein: verified or mezein: waiting, so you can list just the ones from verified people.
5. The author verifies: they sign in with GitHub (only so we know which account it is) and confirm with their pin. The check turns green, now and on their future pull requests.
6. Make it required if you like: in a repository's Settings → Rules, require the mezein: verified person check.
7. Report someone by adding the mezein: report label to their pull request (the app puts it in your repository's labels for you), or by blocking them from your organisation. Either way they can't verify again for your project.

What mezein keeps

To keep one account per person for each project, mezein remembers which GitHub account is verified for which installation. The account id is stored encrypted, usernames aren't kept, and each installation gets its own name for each person, so records for different projects can't be matched up. While a pull request is waiting on its author, mezein remembers its repository, number and latest commit, and forgets them once the author verifies or it closes. Contributors need a mezein pin, and anyone can get one at a table night or with a university email from UCL, King's, Imperial, LSE, Oxford or Cambridge.