A quality gate is an automated pass or fail check that a change must clear before it merges or ships. It combines conditions such as tests passing, analysis results and scan findings into one verdict. It supports human review and does not replace it.
The parts of a gate
A useful gate has three parts. Conditions say what is measured, such as failing tests or new issues of a given severity. A threshold says what counts as a pass. An enforcement point decides where the verdict bites.
On GitHub, enforcement usually means required status checks in a branch protection rule. Each required check must report success, skipped or neutral before collaborators can merge into the protected branch. A stricter option also requires the branch to be up to date with the base branch.
What belongs in a gate
Keep conditions objective and quick to read:
- Build and unit tests pass.
- No new high severity findings from static analysis or dependency scanning.
- No secrets detected in the diff.
- Required reviewers or code owners have approved.
- For AI assisted changes, any extra conditions your team has agreed, such as a required note on which parts were generated.
Subjective questions, such as whether a design is good, stay with reviewers.
What does not belong
Avoid conditions nobody can explain. A gate that fails on a metric the team does not understand trains people to retry until it goes green, or to ask an admin to bypass it.
Also avoid pass conditions that reward gaming. A flat coverage number is a common example, and the post on coverage targets covers why.
Gates and AI assisted work
AI tools raise the volume of changes. A gate scales with volume in a way human attention does not. That makes a gate the right home for rules you can state precisely, and the review conversation the right home for judgment.
Do not make a model's opinion a gate condition on its own. Vendor documentation for review bots says their output is not guaranteed to catch every problem, so use them as advisory input.
Rolling one out
- Start in report only mode and watch the verdicts for two weeks.
- Fix the noisy conditions before enforcing.
- Enforce on new code first. SonarQube's built-in gate applies to new code only, so older debt does not block today's change.
- Define a bypass path with a named approver and a record of each use.
- Review gate results monthly and remove conditions that never fire or always fail.
Click through it at your own pace, or open it full screen.
Quick check
Is a quality gate the same as a code review?
No. A gate checks objective conditions automatically. A review judges design and intent, which needs a person.
How do you enforce a gate on GitHub?
With required status checks in a branch protection rule, so merging is blocked until the checks pass.
Sources
- GitHub Docs, About protected branches
- SonarQube documentation, About new code
- GitHub Docs, Copilot code review
Last reviewed: 19 October 2026.
