Add GitHub pull request creation cap support

README.md

@@ -68,7 +68,11 @@ It operates on a per-branch basis, meaning you can have different settings for d
       <li><a href="#depend_alerts">Dependabot alerts and updates</a></li>
       <li><a href="#GHA_build_status">GitHub Actions build status emails</a></li>
       <li><a href="#pages">GitHub Pages</a></li>
-      <li><a href="#pull_requests">Pull Request settings</a></li>
+      <li><a href="#pull_requests">Pull Request settings</a>
+        <ul>
+          <li><a href="#pr_creation_cap">Pull request creation cap</a></li>
+        </ul>
+      </li>
       <li><a href="#copilot_code_review">Copilot code review</a></li>
       <li><a href="#rulesets">Rulesets</a></li>
       <li><a href="#merge">Merge buttons</a></li>
@@ -769,6 +773,7 @@ Projects can enable/disable various settings for PRs:
 - allow [auto-merging](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request) of PRs
 - allow [updating](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/keeping-your-pull-request-in-sync-with-the-base-branch) head branches of PRs
 - automatically [delete](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches) head branches after merge
+- cap the number of open PRs a user without write access may have at one time (see [creation cap](#pr_creation_cap) below)
 
 Example:
 
@@ -783,6 +788,33 @@ github:
     del_branch_on_merge: true
 ~~~
 
+<h4 id="pr_creation_cap">Pull request creation cap</h4>
+
+You can limit the number of open pull requests a user **without write access** may have open at one
+time. This is GitHub's [pull request creation cap](https://github.blog/changelog/2026-06-17-limit-open-pull-requests-for-users-without-write-access/)
+interaction limit, and it helps mitigate spam or automated PR floods. Users with write access are not
+affected by the cap.
+
+~~~yaml
+github:
+  pull_requests:
+    creation_cap:
+      # turn the cap on or off
+      enabled: true
+      # maximum number of open PRs a user without write access may have (1-1000)
+      max_open_pull_requests: 5
+~~~
+
+Supported settings:
+
+~~~yaml
+enabled: <boolean>                # required
+max_open_pull_requests: <int>     # optional, 1-1000; if omitted, GitHub's default is used
+~~~
+
+Set `enabled: false` to turn the cap off. Removing the `creation_cap` section also disables a cap that
+was previously managed by `.asf.yaml`.
+
 <h3 id="copilot_code_review">Copilot code review</h3>
 
 Copilot code review can review code written in any coding language and provide feedback. It reviews your code from multiple angles to identify issues and suggest fixes, which you can apply with a couple of clicks.

asfyaml/feature/github/__init__.py

@@ -137,6 +137,14 @@ class ASFGitHubFeature(ASFYamlFeature, name="github"):
                     strictyaml.Optional("del_branch_on_merge"): strictyaml.Bool(),
                     strictyaml.Optional("allow_auto_merge"): strictyaml.Bool(),
                     strictyaml.Optional("allow_update_branch"): strictyaml.Bool(),
+                    # Pull request creation cap: limit the number of open pull requests a user
+                    # without write access may have at one time.
+                    strictyaml.Optional("creation_cap"): strictyaml.Map(
+                        {
+                            "enabled": strictyaml.Bool(),
+                            strictyaml.Optional("max_open_pull_requests"): strictyaml.Int(),
+                        }
+                    ),
                 }
             ),
             # Generic repository rulesets
@@ -266,6 +274,7 @@ def run(self):
     features,
     branch_protection,
     pull_requests,
+    pr_creation_cap,
     merge_buttons,
     pages,
     custom_subjects,

asfyaml/feature/github/pr_creation_cap.py

@@ -0,0 +1,106 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""GitHub pull request creation cap support.
+
+Limits the number of open pull requests a user without write access may have open
+at one time, via the repository interaction-limits API. See
+https://github.com/community/maintainers/discussions/840 and
+https://docs.github.com/rest/interactions/repos#update-pull-request-creation-cap-for-a-repository
+"""
+
+import json
+from typing import Any
+
+from . import directive, ASFGitHubFeature
+
+# Bounds enforced by the GitHub API for max_open_pull_requests.
+MIN_OPEN_PULL_REQUESTS = 1
+MAX_OPEN_PULL_REQUESTS = 1000
+
+
+def _creation_cap_url(self: ASFGitHubFeature) -> str:
+    return f"/repos/{self.repository.org_id}/{self.repository.name}/interaction-limits/pulls/creation-cap"
+
+
+def _check_creation_cap_response(self: ASFGitHubFeature, status: int, body: str) -> None:
+    """Raise unless GitHub accepted the creation cap update."""
+    if 200 <= status < 300:
+        return
+    try:
+        parsed = json.loads(body)
+        detail = str(parsed.get("errors") or parsed.get("message") or body)
+    except (json.JSONDecodeError, AttributeError):
+        detail = body
+    repo = f"{self.repository.org_id}/{self.repository.name}"
+    match status:
+        case 403:
+            raise Exception(f"Not allowed to set the pull request creation cap on '{repo}': {detail}")
+        case 404:
+            raise Exception(f"Repository '{repo}' not found or not accessible: {detail}")
+        case 422:
+            raise Exception(f"Validation failed while setting the pull request creation cap: {detail}")
+        case 500:
+            raise Exception(f"GitHub server error while setting the pull request creation cap: {detail}")
+        case _:
+            raise Exception(f"Unexpected response while setting the pull request creation cap: HTTP {status}: {detail}")
+
+
+@directive
+def pr_creation_cap(self: ASFGitHubFeature):
+    pull_requests = self.yaml.get("pull_requests") or {}
+    creation_cap = pull_requests.get("creation_cap")
+
+    previous_yaml = self.previous_yaml if isinstance(self.previous_yaml, dict) else {}
+    previous_pull_requests = previous_yaml.get("pull_requests") or {}
+    was_previously_configured = "creation_cap" in previous_pull_requests
+
+    if creation_cap:
+        enabled = creation_cap.get("enabled", False)
+        # Optional: when omitted (None), the key is left out of the payload below and
+        # GitHub applies its own default cap.
+        max_open_pull_requests = creation_cap.get("max_open_pull_requests")
+    elif was_previously_configured:
+        # The section was removed; disable the cap that .asf.yaml previously managed.
+        enabled = False
+        max_open_pull_requests = None
+    else:
+        return
+
+    if not enabled and not was_previously_configured:
+        return
+
+    payload: dict[str, Any] = {"enabled": enabled}
+    if enabled and max_open_pull_requests is not None:
+        if not MIN_OPEN_PULL_REQUESTS <= max_open_pull_requests <= MAX_OPEN_PULL_REQUESTS:
+            raise Exception(
+                "github.pull_requests.creation_cap.max_open_pull_requests must be between "
+                f"{MIN_OPEN_PULL_REQUESTS} and {MAX_OPEN_PULL_REQUESTS}, got {max_open_pull_requests}"
+            )
+        payload["max_open_pull_requests"] = max_open_pull_requests
+
+    if enabled:
+        if "max_open_pull_requests" in payload:
+            print(f"Setting pull request creation cap to enabled, max {max_open_pull_requests} open per user")
+        else:
+            print("Setting pull request creation cap to enabled")
+    else:
+        print("Disabling pull request creation cap")
+
+    if not self.noop("pr_creation_cap"):
+        status, _headers, body = self.ghrepo._requester.requestJson("PATCH", _creation_cap_url(self), input=payload)
+        _check_creation_cap_response(self, status, body)