Guide — 2 minutes, once per repo

Make sign-off required before merge

fnvibes posts a check called quiz sign-offon every pull request. On its own it's only advice — a red mark nobody has to obey. This is the one step that turns it into a gate, and it lives in GitHub, not here.

Open one pull request first.

GitHub only lets you require a check it has already seen. If quiz sign-off doesn't appear in the search box at step 5, it's because the bot hasn't run on this repo yet — open any pull request, wait for the check to appear on it, then come back.

Using Rulesets (what GitHub uses now)

Most guides still describe the old “Branch protection rules” screen. GitHub replaced it with Rulesets, which is why Settings → Branches may look wrong or empty. Use this instead.

  1. 1

    Open your repo's rulesets

    Go to Settings → Rules → Rulesets in the repo. Or jump straight there: replace the placeholders in github.com/OWNER/REPO/settings/rules.

    Don't see “Rules”? You need admin on the repo. On a personal free account, rulesets work on public repos; private repos need GitHub Pro or an organisation.

  2. 2

    New ruleset → New branch ruleset

    Click New ruleset, then New branch ruleset. Give it a name — something like “Require sign-off”.

  3. 3

    Set enforcement to Active

    Change Enforcement status from Disabled to Active. This is easy to miss, and a ruleset left disabled silently does nothing.

  4. 4

    Target the branches you protect

    Under Target branches choose Add target → Include default branch. That covers main. Add more targets if you merge into release branches too.

  5. 5

    Tick “Require status checks to pass”

    In the Rules list, enable Require status checks to pass. Then click Add checks, type quiz sign-off and select it from the results.

    If nothing matches, see the note at the top — the check has to have run at least once.

  6. 6

    Create it

    Hit Create. From now on the merge button on a targeted branch stays disabled until someone other than the author has passed the quiz.

How to know it worked

Open a pull request. The merge box should say Required status check “quiz sign-off” is expected or show it as failing, and the merge button should be disabled. Pass the quiz and it goes green.

Using classic branch protection

Older repos may still have branch protection rules, which work fine. Go to Settings → Branches → Add branch protection rule, set the branch name pattern to main, tick Require status checks to pass before merging, then search for quiz sign-off and select it. Save.

If a repo has both, the stricter of the two wins.

If it still isn't blocking

  • The check never appears on the PR. The GitHub App needs the pull_request webhook event and write access to Checks. Your connect page warns you when either is missing.
  • Admins can still merge. Rulesets let repo admins bypass by default. Under Bypass list, remove roles you don't want skipping the gate — otherwise the people most likely to rush a merge are exactly the ones it won't stop.
  • Sign-off is per commit.Pushing a new commit clears it and generates a fresh quiz, so the check goes red again. That's deliberate — nobody vouches for code they haven't seen.
  • You turned sign-off off for this repo. With the toggle off in repo settings the check still posts but always passes, so it can never block.

Reviewed, tracked, and actually enforced.

Install it on one repo, open a pull request, and make the check required. That's the whole setup.

Put it on my repo