Zennoxa Shield
Application Security Glossary

Quality Gate

A quality gate is an automated pass/fail checkpoint in a CI/CD pipeline that enforces code-quality standards — such as test coverage, code smells, duplication, and security findings — and blocks changes that fall below the agreed threshold.

A quality gate is a set of conditions that a codebase or a specific change must satisfy before it is allowed to progress in the pipeline. Conditions commonly include a minimum test-coverage percentage, a cap on new code smells or duplicated blocks, no new critical bugs, and no unresolved high-severity security findings on newly changed code.

Gates are usually evaluated in continuous integration. When the change meets every condition the gate passes and the build continues; when any condition fails the gate fails and the merge or deployment is blocked until the issues are addressed. Many teams apply stricter rules to newly written code than to legacy code, so the codebase improves incrementally without requiring a full rewrite.

Quality gates matter because they make "good enough to ship" an explicit, automated, and consistent standard rather than a subjective judgment. They give teams a shared definition of done, prevent regressions from slipping in, and keep technical and security debt from accumulating silently over time.

Frequently asked questions

What is a quality gate?
A quality gate is an automated checkpoint in CI/CD that evaluates a code change against defined quality criteria — such as test coverage, code smells, duplication, and security issues — and passes or fails the build accordingly, blocking changes that don't meet the standard.
How does a quality gate work?
It runs as a CI step after analysis tools produce metrics. The gate compares those metrics to configured thresholds, often applying stricter rules to new code than legacy code, and returns pass or fail. A failure stops the pipeline until the code is brought up to standard.
Quality gate vs security gate?
A quality gate governs overall maintainability and correctness metrics like coverage and duplication, whereas a security gate is narrowly focused on security policy such as vulnerability severity and exposed secrets. They are complementary and frequently run together.

Related terms

Quality Gate — Zennoxa Glossary — Zennoxa Shield