well, I don't know what the answer is. Put it in another repo and give the world write access? Then you gotta deal with spam.

Same with everything else.

We make federated git forge happen? Same problem. There will be tons of spam. So then what do you do? Start whitelisting who is allowed to federate activities?

Now we're back to square one.