Quality gates on new code only: the clean as you code approach

A new code gate judges only what a pull request adds or changes, not the whole repository. It lets a team with a large backlog still hold a firm line on fresh work, and the old code improves as people touch it. It needs care so old risk is not forgotten.

The idea

SonarQube's documentation describes the approach in plain terms. When you change code you usually touch some old code too, so cleaning up new code gradually improves the whole codebase. It defines new code as code recently added or modified. In pull request analysis, that is the code that differs between the PR branch and its target branch.

Its built-in quality gate applies its conditions to new code only. The product also shows new code results and overall results separately, so a project can pass its gate on overall code while new code still has problems.

Why it suits AI assisted teams

AI tools increase the amount of new code. A gate that watches new code directly controls that growth. It also avoids an argument that stalls adoption: nobody has to fix ten years of findings before shipping a feature.

How to set it up

1. Choose how your tool defines new code. SonarQube offers previous version, number of days, specific analysis and reference branch, with previous version as the default. For pull requests, comparing to the target branch is the natural fit.
2. Set conditions on new code only: no new issues above an agreed severity, tests present for new logic.
3. Add a separate view for overall code so debt stays visible.
4. Keep the gate fast so it runs on every push.

Where the approach falls short

• Old risk stays. A serious flaw in untouched code will never fail a new code gate. Run a separate scan of the whole repository on a schedule and route findings to owners.
• Edits near old code. A small change in a risky file may not touch the flawed lines, so the gate passes.
• Definition drift. If the baseline moves, a problem can drop out of the new code window without being fixed. Document the baseline choice.
• Dependencies. A newly published advisory against an existing dependency does not. Scan dependencies continuously.

Pair it with a backlog plan

Give the backlog its own track: a ranked list, an owner and a monthly burn down target. The gate keeps the line from moving backward, and the backlog plan moves it forward.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• SonarQube documentation, About new code

Last reviewed: 19 October 2026.