How about just stop offering a html interface to the code? This doesn't seem like a critical service. Let people clone the repo normally.

If someone else wants to run a public HTML service, let them deal with the bots.

If you really want to offer a web interface, put it behind login. You can apply enough restrictions (captcha, super slow rate limit for new accounts) that it isn't cost effective to generate zillions of logins, and you can monitor logins for bot behavior.

Sucks, but here we are.