Phase 2: Static Analysis & Automated Gates · 55 min · Python · GitHub Actions · Ruff

Configuring Quality Gates

The threshold is not a number. It's a decision about how much risk you accept.

Hiring signal: Engineers who can configure quality gates with the 70-point rubric, composite confidence scoring, and blocking vs advisory thresholds demonstrate the ability to set quality standards that scale across teams using AI at 3-4x commit velocity.

What you will learn

Apply the 70-point quality rubric across 7 scoring categories
Configure blocking vs advisory gates with appropriate thresholds
Implement composite confidence scoring combining multiple check results
Design the ai-quality-gate-V2 7-job CI pipeline

The Problem

You've built the gauntlet (Lesson 5). Now you need to configure the thresholds: when does a PR pass, when is it blocked, when is it advisory? Set thresholds too high and no PR passes -- developers lose trust in the system. Set them too low and bad code reaches production. The 70-point quality rubric and composite confidence scoring give you the framework to make this decision systematically.

The 70-Point Quality Rubric

Category	Max Points	What it measures	Primary tool
Correctness	10	Does the code do what the spec says?	AI Review + Tests
Security	10	Any OWASP Top 10 or CWE patterns?	Semgrep + SAST
Testability	10	Are there tests? Do they cover edge cases?	Coverage + Mutation
Maintainability	10	Is the code readable? Cyclomatic complexity?	Ruff + SonarQube
Performance	10	Any O(n²) loops, unnecessary allocations?	AI Review
Architecture	10	Does it follow existing patterns?	AI Review
Dependencies	10	Any new deps? Are they verified?	Dep Scan + Socket.dev
Total	70

Scoring guidelines

Score Range	Interpretation	Lane	Action
63-70 (90%+)	Excellent quality	Green	Auto-merge eligible
49-62 (70-89%)	Good quality, minor issues	Yellow	Human review required
35-48 (50-69%)	Mediocre quality, concerns	Yellow	Human review + follow-up
< 35 (< 50%)	Poor quality, significant issues	Red	Blocked, must fix

Thresholds are team-specific, not universal
A startup shipping an MVP might set the green threshold at 50 (accept more risk, move fast). A fintech processing payments might set it at 63 (accept less risk, prioritize security). The 70-point rubric is the framework -- your team's risk tolerance determines the thresholds. Document your thresholds and review them quarterly: if too many PRs are green, your thresholds may be too low; if too many are red, they may be too high.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Blocking vs Advisory Gates, Composite Confidence Scoring, The ai-quality-gate-V2 7-Job CI Pipeline, Build It — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.