Disabling PRs on private repos?

[psybers]

Select Topic Area

General

Body

I am using an organization to run a project-based software engineering course. I am not using GitHub Education for this purpose, as the course is not assignment-based.

We work on an open-source project, that I push into a private repository in the organization (it is not a direct fork of the project, to avoid our course sending noise upstream). I then give access to the students, who create their own private forks of that repository.

The problem is that students might sometimes accidentally issue a PR from their repo to the course repo. At that point, the PR is now visible to all students. This means they have exposed their private code to the whole course, which is an academic integrity issue.

Can we lock this down so they can't create PRs? As best I can tell from digging through the documentation, I think the answer is no. If the course repo was public, I could lock it down but even then I can only prevent people outside the organization from opening PRs - my students are in the organization and would still be allowed.

Is there another structure I can use to avoid this problem?