Phase 6: Quality Gates & CI/CD for AI Code · 50 min · Claude Code · GitHub Actions · Python
Building the Quality Gate for Your Product
Five checks, one gate, one rule: any failure blocks the merge. Not four out of five — five out of five.
Hiring signal: A working, composed quality gate — not five separate scripts nobody runs together — is a concrete, portfolio-ready artifact demonstrating the full discipline this phase built, end to end.
What you will learn
- Compose lint, SAST, dependency scan, intent verification, and drift checks into one consolidated quality gate
- Apply the 'any failure blocks the merge' rule across a fully composed gate, not just individual checks
- Explain what a complete quality gate changes about a human reviewer's job, and what it doesn't replace
- Build and verify a working quality gate end to end for your own course-long product
Introduction
Building the Quality Gate for Your Product
Four separate scripts exist in Marcus's repository: a linter, a secrets scanner, an intent-scope checker, and the spec-code drift gate. Each works. None of them run together, and none of them run automatically — Marcus runs whichever one he remembers to run, on whichever PR he remembers to run it against. This is the exact discipline-versus-control gap from earlier in this phase, just multiplied across five checks instead of one. A quality gate that exists as four unconnected scripts, run inconsistently, provides roughly the same protection as no gate at all on the days nobody runs them — which, on a busy day, is most days.
One gate, five checks, one rule
This phase's final artifact composes everything into a single pipeline: lint (style and formatting), SAST (hardcoded secrets, dangerous function calls, swallowed errors), dependency scan (unpinned or banned packages), intent verification (silent-scope and unbacked-claim detection against the PR's stated intent), and the spec-code drift gate (business logic changes without a corresponding spec update). The rule governing all five, together, is the same one from lesson one's green/yellow/red system, now applied across every check rather than just the original three: a single failing check, in any category, is enough to block the merge. This isn't an average, a majority vote, or a weighted score — a PR that passes four of five checks and fails the fifth is exactly as blocked as one that fails all five, because the one failure is real regardless of how many other things went right.
Why "4 out of 5" isn't a passing grade
A PR that passes lint, dependency scan, intent verification, and the drift gate, but fails SAST because it contains a hardcoded secret, is not "80% safe to merge." The secret is either exposed in the shipped code or it isn't — there's no partial-credit version of a leaked API key. Quality gates work because they're binary on each dimension: pass every check, or don't merge, exactly the same principle as c12-03-6's Orbit 1 readiness gate applied here to production CI.
A PR passes lint, dependency scan, and SAST, but fails the spec-code drift check (it changes business logic without updating spec.md) and fails intent verification (it silently touches 40 files when the stated scope was 2). A teammate argues 'it's 3 out of 5 checks passing, and the actual code changes look fine on a skim — let's merge and fix the spec/scope issues in a follow-up.' What's wrong with this reasoning?
This is the same 'update the spec later' promise that c12-01-4's drift gate exists specifically to prevent, now reappearing at the level of the composed quality gate. Each of the five checks catches a different category of problem — passing SAST says nothing about whether the spec was updated, and passing lint says nothing about whether scope silently exploded. A gate with an 'if 3 pass, merge anyway' exception isn't a gate; it's a suggestion with extra steps.
Unlock the full lesson
You've read the first 2 sections. The rest of this lesson covers What the gate changes about human review, Every check earns its place by catching something specific, Making this real for your product, Build It — plus a hands-on lab, quiz, and project artifact.
Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.
Browse all courses · View pricing · DeVenture Academy