Require Status Checks Before Merge with Strict Mode
Enable branch protection with strict status checks so a pull request cannot merge if any required check is pending or failing.
Task
Automate gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=true so pipeline failures are caught before merge and never reach production.
When to use this
A pull request merges with a broken gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=true step because the workflow did not gate on it, causing a failed deploy.
Prerequisites
- Node.js 22 and pnpm available
- A CI workflow file in .github/workflows
Steps
1. Configure gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=true in the project configuration file with the recommended defaults.
gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=true
Expected output: The configuration is accepted and gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=true runs without errors on the first invocation.
2. Run the check locally to verify gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=true produces the expected result before pushing.
pnpm test
Expected output: Local run matches CI behavior; no surprises after push.
3. Add the gate to the CI pipeline so gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=true blocks merge on failure.
- name: Run add required status checks
run: pnpm test
Expected output: Pull requests with failing gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=true are blocked from merging.
Troubleshooting
Problem
The check passes locally but fails in CI
Solution
Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.
Problem
Configuration is rejected with a schema error
Solution
Check the tool version matches the config schema; older versions may not support newer fields.
Limitations
- The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
- Configuration drift is possible if someone edits settings outside version control.
Gate the pipeline before merge
Start by measuring the problem. Enable branch protection with strict status checks so a pull request cannot merge if any required check is pending or failing. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=true against the current codebase and inspect the output before wiring it into CI.
gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=trueMake failures actionable
Once the gate is in place, make failures actionable. A failing gh api -X PUT /repos/$REPO/branches/main/protection -f required_status_checks[strict]=true should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.