Turning off PR CI: local gate with gh-signoff and a required status
Milan Jovanović describes turning off cloud CI for pull requests, running the build and tests locally, and posting a signoff commit status with the gh-signoff GitHub CLI extension. A git pre-push hook runs the gate, a GitHub ruleset requires the status before merging, and one cloud run stays on merges to main. It is a practical option for .NET teams that want to cut Actions costs and waiting time.
Key points
- The local gate script runs dotnet build -warnaserror, dotnet test --no-build and dotnet format --verify-no-changes in order.
- gh extension install basecamp/gh-signoff followed by gh signoff install creates a ruleset that requires a status named signoff on main.
- With strict required status checks enabled, a branch that moves forward needs a rebase, a new gate run and a new signoff.
- A pre-push hook runs only on the local machine and git push --no-verify skips it, so the GitHub-side ruleset is what protects the branch.
- The cloud workflow drops the pull_request trigger and keeps the push to main and the weekly schedule.
- Pull requests from forks cannot be signed off this way, so keep cloud CI for outside contributors.
The author has stopped running GitHub Actions on pull requests in his repository since June. Build, tests and container image steps now run on his own machine, and he reports 833 merged pull requests under this setup. Before the change, the pull request workflow ran 588 times in 19 days, each taking about 2.7 minutes on a 2-core runner, and it repeated the same steps after every merge.
The approach has three parts. A shell script runs the build, tests and formatting check, then posts a commit status named signoff with the gh-signoff extension when everything passes. A git pre-push hook runs the same script before each push, and a GitHub ruleset created by gh signoff install requires that status on main. Cloud CI remains for merges to main and a weekly scheduled run that scans images. The hook alone cannot protect the branch, and forked pull requests cannot be signed off this way.
Real-world use
- A small .NET team whose Actions bill and pull request wait times are high, and who can run the full suite on developer machines in minutes.
- An ASP.NET Core service with Docker-based integration tests that must still block merges on a green check.
- An open-source .NET project where core maintainers sign off locally while outside contributions stay on cloud CI.
Why it matters
You can move the merge gate to developer machines without dropping cloud CI, but it is only safe with a GitHub ruleset and a cloud run after each merge to main. The team has to agree never to post a signoff without running the gate.