Or: how to deal with AI-written pull requests.
Short version of this article
Actually I wrote everything that comes below (it's not that long), but what I really wanted to write was: when people write code by hand, they care more and spot errors more easily than when they ask the AI and "review" later, so human-written code is more trustworthy (on average at least).
Longer version
I was listening to this podcast episode with Richard Feldman and Steve Klabnik about the "AI Discourse" and they touched a point that resonated my own experience. When talking about people that do not want to accept pull requests written by AI, they repeated the argument that in order for this to work you have to review the PR like you would review a PR from anyone, and they thought that settled the matter.
There are many problems with that. No one has time to review infinite PRs coming from whatever source, so other heuristics have to be used, and they are used, even if not consciously: the first is that the very act of writing all the code in a PR serves as a huge proof-of-work. Even if the code is buggy, you can still see at a glance that it is somewhat close to advertised, and why would someone take their time to write all of that in a way that at least looks good if they just wanted to spam you? What if they didn't care much? Every human-written pull request today is filtered by the fact that the person writing it cared. Inversely, writing a PR with an AI is easy and you can do it to spam maintainers, but even if you're not trying to spam, maybe you just care very little, but since it isn't much effort to ask the AI you still do it and submit the PR, but now your code has bugs, you didn't care, it's indistinguishable from spam in practice.
The second, most obvious heuristic is that you have a name, you have a GitHub profile with a past history to honor, so you won't throw it into the mud by submitting spammy buggy PRs, you will do your best work there. But also: if you have a history of being a good developer the maintainer can see that and assume you won't commit very stupid mistakes, for example. No one can verify 100% of the PRs, this kind of trust is assumed, even if you don't think about it.
The third (well, I'm not sure what I'm enumerating anymore) is that if you have to pay too much attention to a PR because it comes from a total stranger, then maybe you can do that every once in a while, if the change is worth merging or if it contains code that you wouldn't or couldn't write yourself, but doing that every single time for every little feature? That's torture, and people will not do it, not even people who like the AI and say they review everything.
Is this a problem in practice?
I mean: can't people just apply these heuristics, specially the third one, to all the AI-submitted code?
If a pull request is coming straight from an LLM (for example, from a GitHub user named Claude) then it's easy to judge it as the potential garbage that it is and apply that (only review carefully and merge if it's worth the trouble, reject everything else as spam).
But what if it's coming from a known GitHub human user with a solid history of writing open-source software? Then I guess it's still reasonable to ask if the code was written with AI, right?
Or should we assume that the individual has carefully reviewed the code generated by his AI before opening the PR? Well, we have already claimed above that no one will do that, so the task is now at the shoulder of the maintainer that is faced with that PR, therefore the maintainer should reasonably ask if the AI wrote it or not, and proceed to treat it as if it has been written by their own AI assistant (why we need external contributors at this point is another question).
Why can't reputation fix this?
One could say that if someone has a GitHub reputation but still goes out there sending AI-written PRs that turn out to be broken and buggy that user would lose reputation.
Well, turns out culture makes a big difference, and if using "that was AI's fault, not mine" becomes an acceptable excuse for bad code, then reputation can no longer be relied upon.