CI, CODEOWNERS, and review evidence
The combination of CI, CODEOWNERS, and required-review rules is what turns "we should review code" into a system. CI runs the automated checks (tests, lint, type, security) on every PR; CODEOWNERS routes the right humans to the right code; required-review rules block merge until both have signed off. None of these alone is sufficient; together they form the gate that keeps main healthy.
CI is the cheap, fast, automated half. Tests run on every push; lint catches style; type-check catches API shape errors; security scans catch known-bad dependencies and obvious leaks. The non-negotiable: CI is required for merge, no exceptions. The way teams break this is by adding "skip CI" tags or merging when CI is "probably fine" — the discipline is to fix the failing check or revert the PR, never to bypass.
CODEOWNERS handles the human routing. The file at .github/CODEOWNERS maps paths to teams or users; combined with branch protection's "Require review from Code Owners," it forces a path-aware review requirement. Auth code requires the auth team. Database migrations require the platform team. Documentation can require just the docs team. The PR review surface auto-assigns; reviewers get focused notifications; merge is blocked until the right humans approve.
Review evidence is the under-appreciated upgrade. Required conversation resolution blocks merge until every PR comment is marked resolved. Stale-approval dismissal revokes prior approvals when new commits land — preventing the "approved early, then I added a sketchy commit" pattern. Signed-off commits (git commit -s) add a Signed-off-by trailer attesting authorship under the project's contributor terms. None are required for small teams; all become essential as the team or repo's risk profile grows.