GitHub, can we please get "is:bot"?
Back in 2021 I reported CVE-2021-22881, which was an open redirection
exploit for Ruby on Rails (Rails) that allowed malicious actors to get
legitimate sites to redirect to their own. In hindsight, I made a couple of
mistakes when I reported this; I used my GitHub username, tktech, as the
reporter, and I used my personal domain, tkte.ch
, in the exploit example.
Not an issue at the time, but since then a multitude of bots have appeared on GitHub to automate dependency updates like renovate, mend, pull, and dependabot.
These bots periodically create automated pull requests to update dependencies for the repositories they're installed on. This is a fantastic feature that saves maintainers a lot of time and effort. The problem is that these bots are indexed by GitHub's search engine.
They're not hard to identify - in search results, [bot]
is appended to the
username ([
not being a valid character in a regular username). When viewing
the PR or issue, a visually distinct bot
badge is displayed next to the bot's
name. This is great! It means GitHub already knows these are bots at the time
they're indexed.
Flash forward to 2024. I'm searching for tktech
in GitHub's search trying to
find out why a repository is suddenly getting so much referral traffic from
GitHub.com. Amazingly, there are 4.4k results for tktech
under pull
requests. I'm flattered, but I know I'm not that popular. Over 90% of these
are automated dependency PRs from the aforementioned bots updating Rails
projects that have been long abandoned. Since the Rails changelog that fixes the
CVE-2021-22881 exploit attributes me by my GitHub username with a leading @,
every single one of these links to me. This is an astonishing amount of noise to
sift through. There is no situation where I would want to see these results,
and they continue multiply every week.
GitHub, can we please get an is:bot
search filter? I would love to be able
to exclude these results from my searches. I'm sure I'm not the only one.
In the meantime, we can resort to using a negation filter to exclude these results:
tktech -author:mend-for-github-com[bot] -author:renovate-bot -author:dependabot[bot] -author:pull[bot] -author:renovate[bot]