There are too many ways to bypass an issue form

[ajsirota]

As spotted by @HonkingGoose (virtual high five!), there are a lot of ways to open an issue and bypass the issue forms:

• Creating an issue from a comment

• Creating an issue from code

• Creating an issue from a project board note

• Creating an issue from a task list item

• Creating an issue from a URL query

• Creating an issue from a discussion

It would be great if you could use the issue chooser YAML file to disable this.

[HonkingGoose]

As spotted by @HonkingGoose (virtual high five!)

Highfive to you too @ajs256 👋

It would be great if you could use the issue chooser YAML file to disable this.

You can already block empty issues that come from the Issues -> New issue -> Template chooser workflow.
But I think that anything outside of the "normal/happy-path/default" web-interface flow for opening an issue is getting passed along as-is.

From the GitHub Docs, configuring the template chooser:

You can customize the issue template chooser that people see when creating a new issue in your repository by adding a config.yml file to the .github/ISSUE_TEMPLATE folder.

You can encourage contributors to use issue templates by setting blank_issues_enabled to false. If you set blank_issues_enabled to true, people will have the option to open a blank issue.

I agree with @ajs256 it would be nice if the enforcement of blank_issues_enabled: false is a lot stronger. Right now there are too many ways to get around it, either on accident or willfully.

It's pretty annoying that maintainers keep having to ask people to pretty please use the templates/forms provided, this is souring both the maintainers and the contributors! I'd really like to see this fixed.

[lukehefson]

Hi @ajs256 & @HonkingGoose. Thanks for pointing these out!

Yes, unfortunately we’re aware of these ways to bypass issue forms (and markdown issue templates too 😬). It’s something that we’d like to fix up / find solutions for in the near future!

[HonkingGoose]

@lukehefson One thing to keep in mind, sometimes you actually want a bot (Sentry/Dependabot/Renovate bot etc.) to be able to open a issue without filling out a form. So going the "nuke it from orbit" way and just blocking all issues which don't go through the form will be counterproductive for some usecases...

[lukehefson]

sometimes you actually want a bot to be able to open a issue without filling out a form

Very true! Thanks for the reminder!

[Bibo-Joshi]

Hi. Somewhat in the directon of @HonkingGoose s last comment: It would be awesome if one could make blank_issues_enabled depend on the users permissions for the repo. i.e. one might want to allow devs to create issues as they see fit while still forcing outsiders to use the provided templates :)

[dirkf]

Critically, if a user comes to GH and selects New Issue, the workflow goes through some JS that prompts for login or registration and then brings up a blank issue. Whereas, if the user happened to be logged in, the New Issue button is a direct link to the template chooser page.

Unfortunately, the sort of users who aren't logged in to GH while navigating the Web are exactly those who would benefit most from the template chooser.

[make-all]

How near future are we talking here? 2028?
Is there an official bug report we can vote up to get it on the radar of the product managers?

[Elliria]

GitHub also offers this at the bottom of the introductory text when a new issue is being created and there doesn't seem to be a way to disable that:

[HonkingGoose]

You can disable blank issues with a config.yml file. But you first need to create either a Issue Template or Issue Form.

https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository#configuring-the-template-chooser

[Elliria]

Ah, yes. You're absolutely right. Thank you.

[jordanbtucker]

How does https://github.com/docker/for-win implement this? When I go to https://github.com/docker/for-win/issues/new it automatically redirects me to https://github.com/docker/for-win/issues/new/choose.

I copied their bug_report.yml and config.yml into my repo to test, but users are still able to get to issues/new instead of getting redirected to issues/new/choose.

[jordanbtucker]

Oh never mind. I'm able to get to the new page as the owner of the repo, but other users aren't.

[make-all]

I think it is based on whether you are already logged in or not. Users who are not logged in end up bypassing the templates after all the redirection surrounding login.