Run tests on PRs and require to pass before merging

[awsarron]

Cover both linting and tests

---

• Create github workflow(s) that run on PR and merge
• Require passing in the repo's Require status checks to passsettings

[agent-of-mkmeral]

Picked this up. Here's where the two boxes stand:

✅ Box 1 — workflows that run on PRs (already done)

​.github/workflows/ci.yml already runs on every PR (opened/synchronize/reopened/ready_for_review) and covers tests + lint-ish gates across all bindings:

• Rust: cargo test --workspace --all-targets + cargo doc with -D warnings (Linux + macOS)
• Python: maturin develop --release + pytest tests/python (Linux + macOS × 3.10–3.14)
• Node: npm run build:debug + npm run typecheck (tsc) + npm test (Linux + macOS × Node 20/22/24)
• Security audit: cargo audit + npm audit --omit=dev

Plus pr-title.yml enforces Conventional Commit titles.

Note: cargo fmt/cargo clippy are intentionally not gated yet (there's a documented cleanup follow-up in ci.yml), and cargo audit is continue-on-error. Those are separate hardening steps from this issue.

⚠️ Box 2 — require checks before merge (needs an admin)

The checks run but nothing requires them — there's no required_status_checks rule anywhere. I opened #37 to make requiring them robust, then the actual "require" toggle needs a maintainer (I only have read access here).

Why #37 first: the matrix expands to ~30 dynamically-named checks (Python (ubuntu-latest, 3.14), Node.js (macos-latest, Node 22), …). Requiring each one in branch protection is brittle — the list silently drifts whenever the matrix changes. #37 adds a single CI Gate job that needs all four jobs and fails unless every one succeeded, so branch protection only has to require that one stable context.

Admin steps once #37 merges

The repo already has a disabled ruleset main-only rules (targets main, enforces 1 review + code-owner review + conversation resolution, squash-only). Enable it and add the status-check rule. Easiest path — Settings → Rules → Rulesets → main-only rules:

1. Set Enforcement status = Active.
2. Add rule “Require status checks to pass” → add check CI Gate (source: GitHub Actions), and tick “Require branches to be up to date before merging”.

Or via API (admin token):

curl -X PUT \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/repos/strands-agents/shell/rulesets/17697137 \
  -d '{
    "enforcement": "active",
    "rules": [
      {"type": "deletion"},
      {"type": "non_fast_forward"},
      {"type": "creation"},
      {"type": "pull_request", "parameters": {
        "required_approving_review_count": 1,
        "dismiss_stale_reviews_on_push": true,
        "require_code_owner_review": true,
        "require_last_push_approval": true,
        "required_review_thread_resolution": true,
        "required_reviewers": [],
        "allowed_merge_methods": ["squash"]
      }},
      {"type": "required_status_checks", "parameters": {
        "strict_required_status_checks_policy": true,
        "required_status_checks": [
          {"context": "CI Gate"}
        ]
      }}
    ]
  }'

(Ruleset 17697137 is the existing main-only rules. You can also require validate-pr-title here if you want the Conventional-Commits check to be a hard gate too.)

TL;DR: #37 lands the CI-side change; a maintainer then flips main-only rules to Active with a CI Gate required check to fully close this.

[zastrowm]

Following #37 I enabled CI Gate to be required