quality-gate_skill

Overview

This skill enforces quality gates for code and operations to block unsafe commits and deployments. It runs layered checks (development, pre-commit, pre-deploy) including syntax, lint, tests, security scans, and production configuration validation. The skill auto-triggers before commits and deploys and generates structured reports with actionable guidance. It integrates with security-review, systematic-debug, and code-review skills for deeper analysis and remediation.

How this skill works

The skill performs three gate levels: Level 1 for continuous development feedback, Level 2 as a pre-commit blocker, and Level 3 as a pre-deploy blocker. It runs commands for syntax/type checks, linting, testing, builds, dependency audits, and OWASP-style scans, and verifies production configuration flags and required secrets. Results are returned as a structured report with pass/fail status, durations, failure details, a verdict (ALLOW/BLOCK), and recommended actions. Failures can auto-trigger linked skills for triage and fixes.

When to use it

• During active development to catch syntax, type, and lint issues early
• On commit attempts to prevent tests or basic security failures from entering VCS
• Before deployment to block releases with failing full tests, detailed security findings, or unsafe production settings
• As an automated gate in CI/CD pipelines to enforce organizational quality standards
• When generating release reports or change approvals to show gate history and verdicts

Best practices

• Run Level 1 checks locally or as pre-push hooks to reduce noisy CI failures
• Fail fast: keep Level 2 and Level 3 strict so only high-quality artifacts reach the repository and production
• Keep tests fast and deterministic; isolate slow integration tests and run them in separate stages
• Treat CRITICAL/HIGH security findings as immediate blockers and track MEDIUM issues with remediation plans
• Keep production flags and required env vars centrally documented and validated by the gate

Example use cases

• Developer runs "quality check" before committing to catch lint and type errors
• CI pipeline runs Level 2 on pull requests to block merges with failing tests or basic security issues
• Pre-deploy pipeline runs Level 3 to verify full test suite, dependency audits, and production configuration before release
• Automated scans detect hard-coded secrets or OWASP issues and open a remediation workflow with security-review
• Generate a gate report to show auditors why a deployment was blocked and what to fix