CommitIQ — Repository Health Intelligence & Contribution Spam Mitigation

Project Overview

CommitIQ is a repository health intelligence service designed to analyze raw commit histories, PR velocity, and contributor patterns for open-source and private engineering projects. By parsing GitHub API telemetry, it converts raw activity into maintainability signals for engineering leads.

The Challenge: Contribution-Farming Incident

During active open-source operations, the repository faced a severe contribution-farming incident. An automated or malicious contributor opened approximately 45 pull requests and 80 issues overnight, overloading notification channels, reviewer bandwidth, and repository triage.

Standard manual moderation was unsustainable. The project required an immediate backend solution to parse commit signals, isolate spam contributions, and prevent automated issue generation without blocking legitimate open-source contributors.

The Solution & Technical Architecture

• FastAPI & Async SQLAlchemy Backend: High-concurrency Python API server capable of querying GitHub REST and GraphQL APIs concurrently without blocking runtime event loops.
• Automated GitHub Actions Rate-Limiting Workflows: Created custom CI/CD bot workflows that detect rapid-fire PR/issue creations, apply triage labels automatically, and enforce contribution rate limits.
• Historical Backfill Scripts: Engineered data backfill scripts to parse existing commit logs, flag suspicious activity bursts, and clean up spam triage data accurately.
• React/TypeScript Analytics Dashboard: Clean, real-time visual dashboard showcasing maintainability metrics, active contributor velocity, and automated flag alerts.

Real Shipped Outcome

The automated rate-limiting workflows and backfill scripts successfully contained the contribution-farming incident, filtered out bot-generated pull requests, and restored maintainer review speed. CommitIQ continues to monitor repository health with automated telemetry signals.