I run a moderately successful open source project on GitHub (it is a privacy enhancing tool for public websites, based upon some PETs I developed for my thesis).

I am getting quite a few feature requests, and some of them are accompanied with pull-requests from people unknown to me. I think it is great that users want to contribute to the project, but I worry about the consequences of incorporating user-contributed code without proper vetting. I am just a one-man show, and do this is my spare time.

What are my options to bring my project forwards with the help of its users?

Are there specific tools on GitHub that will help me doing this?

  • Should this not be on superuser?
    – overactor
    Commented Jul 23, 2015 at 6:06
  • 3
    Both Super User and Web Applications seems to be targeted very much towards end users, not towards maintainers of free software projects. I doubt that you'll get good answers about GitHub tools for project QA on either site. Also, the problem with unknown users submitting pull requests is pretty unique to free software projects, so Programmers, where you'll find some people that knows a lot about Software Engineering (which is the dicipline of QA) does not fit well either. Commented Jul 23, 2015 at 8:34
  • We're apparently allowing questions on hosting platforms (The line still hasn't been clearly set, but the consensus is a yes). Therefore, the question is on-topic.
    – Zizouz212
    Commented Jul 23, 2015 at 14:00
  • 3
    I originally wanted to VTC this question, but couldn't settle on a good close reason. So I decided to try and answer it, and in the process realized that it really did seem to be on topic - at least as far as collaboration is concerned.
    – kdopen
    Commented Jul 23, 2015 at 17:29
  • 1
    And for those still tempted to close, see this meta post which, I think, covers this under collaboration.
    – kdopen
    Commented Jul 24, 2015 at 19:16

3 Answers 3


How about some tools that integrate with GitHub? Do you unit test your code? (Hint: You should be.) Set yourself up with a build server to automatically run the tests when a pull request is received. The tool you use will likely be dependent on the language you're writing in, but AppVeyor and TravisCI are both popular solutions that integrate extremely well into GitHub. Both of them will seamlessly display a pass/fail indication right on the GitHub PR. This makes it easy to tell if the PR broke anything.

Since we're talking about tests, look into Code Coverage tools that integrate with GitHub too. While CI servers can help you tell if anything existing was broken, these tools help you determine if the submitter bothered to include tests for new features. Coveralls is one such popular tool.

  • Apart of TravisCi, there is also App Veyor, but mostly for Windows app.
    – kenorb
    Commented Aug 20, 2015 at 14:04
  • @kenorb yup. I mentioned appveyor and that which you pick will be driven mostly by the language you're using.
    – RubberDuck
    Commented Aug 20, 2015 at 14:40
  • I'm sure you're gone by now down voter, but I appreciate explanations. Without one, how am I to improve my answer??
    – RubberDuck
    Commented Aug 21, 2015 at 22:12

In a way you are already moving forward with help from the community; that's what those pull requests are.

In addition to pull-requests, you have other tools at your fingertips

The project wiki

Which you may or may not have enabled. Like any wiki, this can double as a way for you to make announcements (publish guidelines for contributions, etc to your community) and a forum for discussion.

Pull requests

In addition to making you aware of changes others would like to see included in your project, these also act as a forum for code reviews. Others who are interested can see the changes and make comments directly against the commits included in the request.

This relieves you a little of the burden of reviewing incoming requests, though as the project owner you still have the final say on which to take and when they are taken.


Github also provides you with a rudimentary issue tracker for your project, allowing you to set release dates, assign them to individuals for resolution, classify them via tags, and so on .


When you get to know a few regular contributors well, you have the ability (under Collaborators on the project's settings page) to grant merge access to other people. This allows them to accept pull requests and push changes directly to the main repository.

In Summary

Github provides you with everything you need to run a small development project and manage who can do what. It's up to you to make use of them.

If your project is successful enough to be attracting contributions from complete strangers, then it's off to a good start. But if you ignore your contributors one of them is going to fork it, accept the other people's changes, and effectively take the project away from you.

  • Don't forget the GitHub API that can integrate with third party tools (or tools you build in-house). Commented Jul 23, 2015 at 5:01
  • @Bob A CLA is not specific to Github
    – kdopen
    Commented Jul 23, 2015 at 15:43
  • @kdopen Ah, I missed the emphasis on specific.
    – Bob
    Commented Jul 23, 2015 at 16:22

In addition to things already mentioned, GitHub recognizes a special "CONTRIBUTING" file (either with .md or .rst extension). If this file exists in your repo, the message "Please review the guidelines for contributing to this repository." will show up with a link to that file when someone creates a new issue.

You can use that to be a tad more explicit about what you expect from a contribution or issue.

See this example of a GitHub contributing file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.