Required status checks for AI assisted pull requests, step by step

To hold AI assisted pull requests to the same bar as any other, require status checks, require approvals, dismiss stale approvals and require code owner review on your protected branches. The rules apply to everyone, so they cover code written by a person, an assistant or an agent.

Step 1: protect the branch

Create a branch protection rule or a ruleset for your default branch. GitHub's documentation explains that required status checks must report success, skipped or neutral before anyone can change the protected branch. Rulesets are an alternative to branch protection rules, and the two can be applied together.

Step 2: choose the checks

Require the ones you trust: build, unit tests, linting, dependency scan, secret scan. Name them explicitly in the rule. A check you do not require is only advice.

Be careful with checks that can report skipped. GitHub counts skipped as acceptable, so a workflow that silently skips on certain paths can let a change through. Test your own workflows with a path filter and see what the pull request shows.

Step 3: strict or loose

Strict checks also require the branch to be up to date with the base branch. That is safer, since the tests run against what will actually merge, but it costs extra runs on busy repos. Pick strict for repositories where a bad merge is expensive.

Step 4: require reviews and dismiss stale approvals

Require at least one approving review. Turn on dismissal of stale approvals. GitHub dismisses an approval if the diff changes after approval, for example when new commits are pushed. That matters for agent generated work, where a follow up commit can change a lot after someone approved.

Step 5: code owners

Add a CODEOWNERS file and enable the option requiring review from code owners. Owners are requested automatically when files they own change, and any one of them satisfies the rule. Assign an owner to the CODEOWNERS file itself, so the rule cannot be edited quietly. Draft pull requests do not request owners until they are marked ready.

Step 6: keep bots in their lane

An AI review is advisory unless you deliberately decide otherwise. GitHub says Copilot reviews do not count toward required approvals unless Copilot approvals are enabled. Leave it that way for production code.

Step 7: test the rule

Open a throwaway pull request from a branch with a failing test and confirm the merge is blocked. Then try an approval followed by a new commit and confirm it is dismissed. A rule you have not tested is a guess.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub Docs, About protected branches
• GitHub Docs, About code owners
• GitHub Docs, Copilot code review

Last reviewed: 19 October 2026.