Quality Gates Enforcer

Enforce minimum quality standards before merging code.

Coverage Requirements

.github/workflows/quality-gates.yml

name: Quality Gates

on: pull_request:

jobs: coverage: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

  - uses: actions/setup-node@v4
    with:
      node-version: "20"
      cache: "npm"

  - run: npm ci

  - name: Run tests with coverage
    run: npm test -- --coverage

  - name: Check coverage threshold
    run: |
      COVERAGE=$(node -p "require('./coverage/coverage-summary.json').total.lines.pct")
      THRESHOLD=80

      if (( $(echo "$COVERAGE < $THRESHOLD" | bc -l) )); then
        echo "❌ Coverage $COVERAGE% is below threshold $THRESHOLD%"
        exit 1
      fi

      echo "✅ Coverage $COVERAGE% meets threshold $THRESHOLD%"

  - name: Comment coverage on PR
    uses: romeovs/lcov-reporter-action@v0.3.1
    with:
      lcov-file: ./coverage/lcov.info
      github-token: ${{ secrets.GITHUB_TOKEN }}
      delete-old-comments: true

Jest Configuration

// jest.config.js module.exports = { coverageThreshold: { global: { branches: 80, functions: 80, lines: 80, statements: 80, }, "./src/critical/": { branches: 90, functions: 90, lines: 90, statements: 90, }, }, };

Linting Gate

lint: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

- uses: actions/setup-node@v4
  with:
    node-version: "20"
    cache: "npm"

- run: npm ci

- name: Run ESLint
  run: npm run lint -- --max-warnings 0

- name: Check formatting
  run: npm run format:check

Type Checking Gate

typecheck: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

- uses: actions/setup-node@v4
  with:
    node-version: "20"
    cache: "npm"

- run: npm ci

- name: TypeScript check
  run: npx tsc --noEmit

Security Scanning

security: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

- name: Run Snyk security scan
  uses: snyk/actions/node@master
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  with:
    args: --severity-threshold=high

- name: Audit dependencies
  run: npm audit --audit-level=moderate

- name: Check for outdated dependencies
  run: |
    OUTDATED=$(npm outdated || true)
    if [ ! -z "$OUTDATED" ]; then
      echo "⚠️ Outdated dependencies found:"
      echo "$OUTDATED"
    fi

Bundle Size Gate

bundle-size: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

- uses: actions/setup-node@v4
  with:
    node-version: "20"
    cache: "npm"

- run: npm ci
- run: npm run build

- name: Check bundle size
  uses: andresz1/size-limit-action@v1
  with:
    github_token: ${{ secrets.GITHUB_TOKEN }}
    skip_step: install

Required Status Checks

.github/workflows/required-checks.yml

name: Required Checks

on: pull_request:

jobs: required: runs-on: ubuntu-latest needs: [lint, typecheck, test, coverage, security] if: always() steps: - name: Check all required jobs passed run: | if [ "${{ contains(needs.*.result, 'failure') }}" == "true" ]; then echo "❌ Required checks failed" exit 1 fi echo "✅ All required checks passed"

Quality Thresholds

// quality-thresholds.ts export const QUALITY_GATES = { coverage: { lines: 80, branches: 80, functions: 80, statements: 80, }, linting: { maxWarnings: 0, maxErrors: 0, }, bundleSize: { maxSize: "200kb", maxGzipSize: "100kb", }, performance: { maxLighthouseScore: 90, }, security: { maxVulnerabilities: 0, maxSeverity: "moderate", }, dependencies: { maxOutdated: 5, }, };

Branch Protection Rules

Configure via GitHub settings or API

{ "required_status_checks": { "strict": true, "contexts": ["lint", "typecheck", "test", "coverage", "security", "bundle-size"], }, "required_pull_request_reviews": { "required_approving_review_count": 1, "dismiss_stale_reviews": true, "require_code_owner_reviews": true, }, "enforce_admins": true, "restrictions": null, }

Quality Report

• name: Generate quality report run: | cat > quality-report.md << EOF

  Quality Report

  Coverage

  • Lines: $(node -p "require('./coverage/coverage-summary.json').total.lines.pct")%
  • Branches: $(node -p "require('./coverage/coverage-summary.json').total.branches.pct")%
  • Functions: $(node -p "require('./coverage/coverage-summary.json').total.functions.pct")%

  Linting

  • ESLint warnings: $(npm run lint 2>&1 | grep -c warning || echo 0)
  • ESLint errors: $(npm run lint 2>&1 | grep -c error || echo 0)

  Type Safety

  • TypeScript errors: $(npx tsc --noEmit 2>&1 | grep -c error || echo 0)

  Security

  • Vulnerabilities: $(npm audit --json | jq '.metadata.vulnerabilities.total')

  Bundle Size

  • Main bundle: $(ls -lh dist/main.js | awk '{print $5}') EOF

• name: Comment report on PR uses: actions/github-script@v7 with: script: | const fs = require('fs'); const report = fs.readFileSync('quality-report.md', 'utf8'); github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: report });

Auto-fail on Thresholds

• name: Check all quality gates run: | EXIT_CODE=0

  Coverage

  COVERAGE=$(node -p "require('./coverage/coverage-summary.json').total.lines.pct") if (( $(echo "$COVERAGE < 80" | bc -l) )); then echo "❌ Coverage below 80%" EXIT_CODE=1 fi

  Lint warnings

  WARNINGS=$(npm run lint 2>&1 | grep -c warning || echo 0) if [ "$WARNINGS" -gt 0 ]; then echo "❌ Found $WARNINGS lint warnings" EXIT_CODE=1 fi

  TypeScript errors

  if ! npx tsc --noEmit; then echo "❌ TypeScript errors found" EXIT_CODE=1 fi

  Security vulnerabilities

  if ! npm audit --audit-level=moderate; then echo "❌ Security vulnerabilities found" EXIT_CODE=1 fi

  exit $EXIT_CODE

Best Practices

• Strict thresholds: No compromises on quality

• Fast feedback: Run checks early in CI

• Clear messages: Explain why checks failed

• Incremental improvement: Gradually increase thresholds

• Bypass mechanism: For emergencies only

• Local pre-commit: Catch issues before push

• Team agreement: Align on standards

Output Checklist

• Coverage threshold enforced (80%+)

• Linting with zero warnings

• Type checking required

• Security scanning enabled

• Bundle size checks

• Branch protection rules

• Quality report generated

• PR comments automated