PR Hygiene: The Checks That Belong in Every Pull Request

Four things should stop a pull request before anyone reads it: a leftover merge-conflict marker, a debug statement, a hardcoded secret, and a focused or skipped test. That short list is the core of PR hygiene, and none of it is a style preference. A second group, made up of untracked TODOs, blanket lint suppressions, source changes with no test and oversized diffs, deserves a warning, not a block, so a reviewer sees it without the push being stopped.

The four checks that block

If any of these is in the diff, the PR is not ready:

• Leftover merge-conflict markers. A line that starts with seven <, = or > characters means a conflict was never resolved. The file just stopped causing an error.
• Debug statements. console.log, a bare debugger, breakpoint(), pdb.set_trace(), var_dump or print_r left in committed code means a debugging session never got cleaned up.
• Hardcoded secrets. API keys, tokens and passwords typed into source. The pack's gate looks for high-signal shapes: AWS key IDs starting AKIA, keys starting sk-, GitHub tokens starting ghp_, private-key headers, and names like api_key or password assigned a long literal. A secret pushed once stays in git history, so the fix ends with rotating the key. Our guide to exposed API keys and secrets walks through it.
• Focused or skipped tests. A .only, .skip, fdescribe or xit means part of the suite quietly stopped running. CI still reports green while checking less than it claims.

The four checks that warn

These deserve a reviewer's attention, but context can make each one fine, so they should not stop a push on their own:

• Untracked TODOs. A new TODO or FIXME with no issue number, ticket ID such as ABC-123, or @owner tends to become permanent once merged.
• Blanket lint suppressions. An eslint-disable that switches a rule off for a whole file hides every future violation in it, not just the one that annoyed someone today.
• Source changed with no test. Not every change needs a new test. A logic change with no test file anywhere in the diff is still worth a second look.
• Oversized diffs. A big diff is harder to review carefully. The pack's gate warns past 600 added lines by default, and you can change the number.

What a diff-scoped check cannot see

A hygiene gate reads the lines you added in this change. That keeps it fast and quiet, and it also means old problems are invisible to it. A key committed last year in a file you did not touch never appears in the current diff. Neither does a key you deleted in this PR, even though it is still sitting in the history.

False positives pull the other way. In a command-line tool, console.log is the output, not leftover debugging. The pack's gate lets you skip a rule with --allow, and its own reference says to use that sparingly and say why. The catch is that a skipped rule is skipped for the whole diff, so one exception for one file turns the check off everywhere in that run. There is no clean answer here. Narrow exceptions take more setup, and broad ones get forgotten.

Where the checks run

1. Locally, before push. Wire the gate into a pre-push hook so a blocking issue never leaves your machine. See how to gate bad commits before they reach CI.
2. In CI, as a required check. The same script exits non-zero on BLOCK. GitHub's docs say that once status checks are required on a protected branch, all of them must pass before collaborators can merge.
3. Next to human review. The gate clears the mechanical issues, so a reviewer's attention goes to logic, design and intent.

None of this is a security audit, and the gate does not judge whether the change is the right one. For validated, whole-repo security analysis, use a dedicated SAST tool such as Snyk or SonarQube.

Pairs well with

If the codebase is inherited, not new, the Codex Migration & Refactor Pack ($99) handles framework upgrades, dependency sweeps and dead-code removal, with a verifier that returns SHIP or HOLD. For apps built with AI builders, the Vibe-Coded App Pre-Launch Security Gate ($79) grades six security controls, including secrets kept out of the client bundle and repo, before launch. If your app calls an LLM, the Prompt Regression Lab ($89) applies the same idea to prompts: it diffs a committed baseline and fails CI on any regression.