feat: pr quality

[avivkeller]

Closes PRs who's quality appears to be spammy and/or robotic.

Ref: https://github.com/webpack/webpack.js.org/blob/main/.github/workflows/pr-quality.yml

[cursor]

PR Summary

Medium Risk
Uses pull_request_target with pull-requests: write, which can affect PR lifecycle and needs trust in the pinned upstream reusable workflow.

Overview
Adds a PR Quality GitHub Actions workflow that runs when pull requests are opened or reopened, using pull_request_target and granting pull-requests: write (plus read on contents and issues).

The only job, anti-slop, calls the pinned reusable workflow webpack/.github/.github/workflows/pr-quality.yml@a03552c758d8c244b3cfc2985aff7020469e0473, aligning with the webpack.js.org setup to flag or close PRs that look spammy or robotic.

^{Reviewed by Cursor Bugbot for commit 2f951a5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api-docs-tooling	Ready	Preview	Jul 18, 2026 5:11am

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.17%. Comparing base (4534824) to head (2f951a5).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #915   +/-   ##
=======================================
  Coverage   86.17%   86.17%           
=======================================
  Files         188      188           
  Lines       17146    17146           
  Branches     1540     1539    -1     
=======================================
  Hits        14776    14776           
  Misses       2363     2363           
  Partials        7        7           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

api-links Generator

Performance

Metric	Base	Head	Diff
Elapsed time	1.28 s	1.44 s	+160.00 ms (+12.50%)
User CPU time	2.75 s	2.85 s	+100.00 ms (+3.64%)
System CPU time	340.00 ms	370.00 ms	+30.00 ms (+8.82%)
Peak resident memory	348.51 MB	357.05 MB	+8.54 MB (+2.45%)

legacy-html Generator

Performance

Metric	Base	Head	Diff
Elapsed time	12.46 s	21.27 s	+8.81 s (+70.71%)
User CPU time	39.93 s	67.65 s	+27.72 s (+69.42%)
System CPU time	1.60 s	2.59 s	+990.00 ms (+61.87%)
Peak resident memory	2.33 GB	2.10 GB	-232.82 MB (-9.78%)

legacy-json Generator

Performance

Metric	Base	Head	Diff
Elapsed time	10.23 s	7.96 s	-2.27 s (-22.19%)
User CPU time	27.83 s	24.02 s	-3.81 s (-13.69%)
System CPU time	2.06 s	1.50 s	-560.00 ms (-27.18%)
Peak resident memory	1.69 GB	1.70 GB	+3.52 MB (+0.20%)

llms-txt Generator

Performance

Metric	Base	Head	Diff
Elapsed time	7.74 s	9.03 s	+1.29 s (+16.67%)
User CPU time	23.79 s	24.29 s	+500.00 ms (+2.10%)
System CPU time	1.32 s	1.93 s	+610.00 ms (+46.21%)
Peak resident memory	1.57 GB	1.61 GB	+39.70 MB (+2.47%)

orama-db Generator

Output size

| File | Base | Head | Diff |

|-|-|-|-|

| orama-db.json | 8.90 MB | 8.89 MB | -1.33 KB (-0.01%) |

Performance

Metric	Base	Head	Diff
Elapsed time	8.38 s	9.29 s	+910.00 ms (+10.86%)
User CPU time	23.44 s	26.19 s	+2.75 s (+11.73%)
System CPU time	1.44 s	1.91 s	+470.00 ms (+32.64%)
Peak resident memory	1.59 GB	1.74 GB	+148.18 MB (+9.09%)

web Generator

Output size

| File | Base | Head | Diff |

|-|-|-|-|

| all.html | 21.27 MB | 21.27 MB | -158.00 B (-0.00%) |

Performance

Metric	Base	Head	Diff
Elapsed time	77.88 s	75.53 s	-2.35 s (-3.02%)
User CPU time	161.49 s	162.02 s	+530.00 ms (+0.33%)
System CPU time	4.90 s	4.58 s	-320.00 ms (-6.53%)
Peak resident memory	5.59 GB	5.28 GB	-314.64 MB (-5.50%)

[bmuenzenmeyer]

Note to self and others. That link goes to the usage but it looks like the meat is at

• https://github.com/webpack/.github/blob/main/.github/workflows/pr-quality.yml
• and https://github.com/peakoss/anti-slop

[avivkeller]

Ack! I meant to link webpack/.github@main/.github/workflows/pr-quality.yml but had the wrong thing in my clipboard 🤦

[avivkeller]

@nodejs/web-admins btw

[avivkeller]

@nodejs/web-infra

[AugustinMauroy]

Seem resonable

[bmuenzenmeyer]

can you show us some evidence of how this working within webpack? i am a bit on the fence yet - in part because

• we are using a webpack tool, not the "first" party. this creates interesting relationships where now webpack workflows have a downstream dependent they might not realize, and vice versa
• i feel like this was a response to a couple good first issue labels i made that generated temporary land rush interest, which, perhaps we simply stop.
• pull_request_target

[avivkeller]

• we are using a webpack tool, not the "first" party. this creates interesting relationships where now webpack workflows have a downstream dependent they might not realize, and vice versa

It's bound to the specific commit, so if that workflow breaks in the future, it won't affect us.

• i feel like this was a response to a couple good first issue labels i made that generated temporary land rush interest, which, perhaps we simply stop.

I don't think we should stop doing that, it's important to have good first issues, but we do see an influx of spammy PRs in this repo.

• pull_request_target

It needs permissions to close spam PRs

[bmuenzenmeyer]

i am 👍 on this after can you show us some evidence of how this working within webpack?

[avivkeller]

https://github.com/search?q=org%3Awebpack+%22%F0%9F%91%8B+Hi+there%21+This+PR+was+automatically+flagged+and+closed+by+our+quality+checks.%22&type=pullrequests shows closed PRs, like:

webpack/webpack#20805
webpack/webpack#20874