Or you can be like Zend Framework and just ignore a ticket with a working patch and then months later have someone else to win a tee-shirt because that someone who has write access to the repository just participate to a bug hunt. Sometimes people want your code. They just don't want you.
This is probably what I would use for PHP, but obviously other languages have better solutions like ruby/sinatra, python/flask etc.