qcUse this skill when the user says 'code quality', 'quality gate', 'static analysis', 'coding standards', 'peer review', 'code coverage', 'cyclomatic complexity', 'lint rules', 'technical debt', 'quality metrics', 'quality dashboard', 'SonarQube', 'ESLint', 'quality checklist', or needs quality control. Covers: quality gates, static analysis enforcement, cod…
Independent GitHub snapshot · Automated classification · Original documentation governs
Enforce code quality standards through quality gates, static analysis, peer reviews, and quality metrics automation.
Exact user phrases: "code quality", "quality gate", "static analysis", "coding standards", "peer review", "code coverage", "cyclomatic complexity", "lint rules", "technical debt", "quality metrics", "quality dashboard", "SonarQube", "ESLint", "quality checklist", "quality gate failing", "coverage threshold".
Before activating, verify:
No file output. This skill produces text guidance, quality gate configurations, or quality reports.
Answer exactly:
| Metric | Threshold | Actual | Status |
|---|---|---|---|
| ... | ... | ... | ... |
{list of violations with file:line}
{list of required fixes}
No preamble. No postamble. No explanations. No filler/hedging/transitions. Compress output — why use many token when few do trick. No explanations of why quality matters.
This skill is complete when:
Quality report: 25 lines. Gate configuration: 20 lines.
| Metric | Threshold | Tool |
|---|---|---|
| Code coverage | >= 80% (overall), >= 90% (new code) | Istanbul, JaCoCo, cargo-tarpaulin |
| Cyclomatic complexity | <= 10 per function | ESLint complexity, Radon |
| Duplication | < 3% | SonarQube, PMD |
| Code smells | 0 blocker/critical | SonarQube, CodeClimate |
| Security hotspots | 0 | SonarQube, CodeQL |
| Test success rate | 100% | CI pipeline |
| Lint errors | 0 | ESLint, Ruff, golangci-lint |
| Dependency vulnerabilities | 0 critical/high | npm audit, cargo audit, govulncheck |
gates:
coverage:
overall: 80
new_code: 90
complexity:
max_per_function: 10
max_per_file: 50
duplication:
max_percent: 3
lint:
errors: 0
warnings: 100
security:
critical: 0
high: 0
medium: 5
TypeScript / JavaScript:
{
"extends": ["eslint:recommended", "plugin:@typescript-eslint/strict"],
"rules": {
"complexity": ["error", 10],
"max-lines-per-function": ["warn", 50],
"no-console": "error"
}
}
Python:
[tool.ruff]
line-length = 100
select = ["E", "F", "I", "N", "W", "C90"]
[tool.ruff.mccabe]
max-complexity = 10
Go:
linters:
enable:
- errcheck
- gosimple
- govet
- staticcheck
- cyclop
- dupl
linters-settings:
cyclop:
max-complexity: 10
| Category | Examples | Action |
|---|---|---|
| P0 — Critical | Security vulnerability, data corruption | Fix immediately, stop the line |
| P1 — High | Performance bottleneck, missing error handling | Fix this sprint |
| P2 — Medium | Code duplication, dead code | Schedule within 2 sprints |
| P3 — Low | Style inconsistencies, naming issues | Fix opportunistically |
| ID | Area | Issue | Severity | Effort | Sprint |
|---|---|---|---|---|---|
| TD-01 | PaymentService | Cyclomatic complexity 24 | High | 3d | Sprint 5 |
| TD-02 | UserModule | 15% duplication in validators | Medium | 1d | Sprint 6 |
| TD-03 | ApiClient | No retry logic on 5xx | Critical | 0.5d | Sprint 4 |
jobs:
quality:
runs-on: ubuntu-latest
steps:
- run: npm run lint
- run: npm run test -- --coverage
- run: npm audit --audit-level=high
- uses: sonarsource/sonarqube-scan-action@v2
Define a quality dashboard visible to the entire team containing:
Automate quality checks in PR workflow:
Schedule recurring quality reviews:
Define escalation path for quality violations:
| Aspect | ISO 25010 | SQALE | CISQ | SonarQube Way |
|---|---|---|---|---|
| Origin | ISO standard | Maintainability model | Consortium standard | Open-source |
| Dimensions | 8 quality characteristics | 7 maintainability factors | 4 code quality metrics | 5 axes (reliability, security, maintainability, coverage, duplications) |
| Scoring | Weighted sub-characteristics | Remediation cost | Automated measurement | Rating A-E per axis |
| Best for | Formal assessments | Technical debt cost estimation | Enterprise procurement | Day-to-day CI enforcement |
| Complexity | High | Medium | Low | Low |
What is your primary goal?
├── Enforce minimum standards in CI
│ └── Use SonarQube Quality Gate with tool-specific linters
│ └── Language? JS/TS → ESLint + Jest + SonarQube
│ └── Python → Ruff + pytest-cov + SonarQube
│ └── Go → golangci-lint + go test + govulncheck
│ └── Rust → clippy + cargo-tarpaulin + cargo-audit
├── Measure and reduce technical debt
│ └── Use SQALE model with remediation cost estimation
│ └── Track TD ratio (remediation cost / development cost)
│ └── Target: TD ratio < 5%
├── Prepare for external audit or compliance
│ └── Use ISO 25010 with full documentation
│ └── Map controls to quality characteristics
│ └── Generate compliance evidence automatically
└── Procurement or vendor evaluation
└── Use CISQ automated measurement
└── Request SBOM with CISQ metrics
| Level | Stage | Characteristics | Automation |
|---|---|---|---|
| 1 | Initial | No standards, manual reviews | None |
| 2 | Managed | Basic linter, coverage targets | Pre-commit hooks |
| 3 | Defined | Quality gates in CI, rules defined | PR checks |
| 4 | Measured | Dashboard, trend analysis, TD tracking | Automated reporting |
| 5 | Optimizing | AI-assisted review, predictive quality | Continuous improvement |
| Phase | Gate | Minimum Pass |
|---|---|---|
| Design | Architecture review, ADR | All concerns addressed |
| Development | Pre-commit hooks, local lint | Zero errors |
| Pull request | CI quality gates, peer review | All gates pass |
| Staging | Integration tests, security scan | All critical pass |
| Production | Smoke tests, canary analysis | Zero errors |
| Post-release | Monitoring, error budgets | SLO within budget |
Raising coverage thresholds without ensuring test quality leads to worthless tests. Teams write getter/setter tests that exercise code but assert nothing meaningful. Always pair coverage targets with mutation testing (Stryker, PIT) to measure assertion effectiveness.
Setting only overall coverage targets allows teams to meet thresholds by covering only legacy code while new code remains untested. Always separate overall and new code coverage. New code coverage should be 10% higher than overall.
Applying a blanket cyclomatic complexity limit of 10 everywhere ignores legitimate complexity in state machines, parsers, or complex business rules. Use complexity limits with exemptions for well-documented cases, or use cognitive complexity instead.
Enabling every lint rule creates noise that desensitizes the team. Important violations get lost in hundreds of warnings. Start with the strict preset, then selectively disable low-value rules. Keep warning count manageable (< 100 warnings in the entire codebase).
Teams create a technical debt register during the first quality initiative and never update it. The register becomes stale and irrelevant. Integrate TD tracking into the sprint planning process. Review and update the register every sprint.
If quality gates can be bypassed with a manager's approval, engineers will stop respecting them. Make overrides rare, documented, time-boxed, and visible to the entire team. An override that expires in 7 days is more honest than an indefinite exception.
Running a quality improvement sprint and declaring victory creates a temporary spike that decays. Quality is a continuous practice, not a project. Embed quality checks in every stage of development. Automate enforcement to prevent regression.
Using quality metrics to evaluate individual performance creates perverse incentives — engineers game the numbers instead of improving quality. Quality data is process data, not people data. Focus metrics on the system, not individuals.
Focusing quality efforts exclusively on first-party code while ignoring npm packages, PyPI dependencies, and container base images leaves significant risk unaddressed. Run npm audit, cargo audit, govulncheck, and container scanning in CI. Maintain an SBOM for every release.
Automating every aspect of code review (format, lint, complexity, coverage) can create a false sense of security. Automated tools catch style and obvious bugs but miss architectural issues, design problems, and subtle logic errors. Automated gates are a floor, not a ceiling.
exception_id: QE-{date}-{n}
requestor: {name}
gate: {gate_name}
reason: {business justification}
duration: {expiry date or sprint}
approved_by: {manager/lead}
status: open / approved / rejected / expired
mitigation: {compensating controls if any}
register:
- id: TD-{n}
module: {service/module name}
description: {clear description of the debt}
category: design / test / documentation / security / performance
severity: critical / high / medium / low
effort_estimate: {person-days}
identified_by: {name}
identified_date: {date}
sprint_target: {sprint}
owner: {team or person}
status: backlog / triaged / in_progress / fixed / verified / accepted
remediation_notes: {optional notes}
{
"dashboard": {
"panels": [
{"title": "Coverage Trend", "type": "graph", "target": "avg_coverage"},
{"title": "Gate Status", "type": "stat", "target": "gate_pass_rate"},
{"title": "TD Ratio", "type": "gauge", "target": "td_ratio"},
{"title": "Defect Density", "type": "heatmap", "target": "defects_per_kloc"},
{"title": "Build Health", "type": "table", "target": "build_duration_health"}
]
}
}
name: Quality Gate
on: pull_request
jobs:
quality:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
- run: npm ci
- run: npm run lint
- run: npm run test -- --coverage
- uses: sonarsource/sonarqube-quality-gate-action@v2
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- run: npm audit --audit-level=high
A 40-person fintech startup faced frequent production incidents due to untested code, high complexity, and unchecked dependencies. They implemented quality gates in CI: 80% coverage, zero lint errors, zero critical dependencies, complexity < 15. After 3 months, production incidents dropped 70%. After 6 months, deployment frequency doubled. Key success factor: executive sponsorship made gates non-negotiable.
A mature e-commerce platform had accumulated 18 months of technical debt with a TD ratio of 32%. They established a quality register, allocated 20% of every sprint to TD reduction, and used SQALE remediation cost to prioritize. In 2 quarters, TD ratio dropped to 8%. The key insight: measuring remediation cost in currency (dollars) made the business case for quality improvement self-evident.
An enterprise SaaS company allowed blanket exceptions to quality gates for critical customer deployments. Within 3 months, 80% of deployments used exception overrides. Quality metrics collapsed. The fix: implementing a time-boxed exception system with automatic expiry, visibility to the CTO, and a mandatory follow-up remediation plan. Exceptions dropped to < 5% of deployments within 6 weeks.
An open-source project with 500+ contributors needed consistent quality across PRs from external contributors. They implemented automated quality gates: lint, test coverage > 75%, no new SonarQube issues. Maintainers reviewed only code that passed automated gates. PR merge time decreased from 14 days to 3 days, and defect rate dropped 45%.
After completing this skill:
| Decision Point | Option A | Option B | Decision Criteria |
|---|---|---|---|
| Gate timing | Pre-merge (slower PRs but clean) | Post-merge (fast PRs but risk) | Team size, release frequency |
| Coverage threshold | Line coverage (exists in all tools) | Branch coverage (more meaningful) | Tool support, regulatory needs |
| Enforcement | Soft (informational) | Hard (blocking) | Maturity, project phase |
yaml quality_gate: code_coverage: minimum: 80 fail_on_drop: true test_pass_rate: minimum: 100 required: true lint_errors: maximum: 0 required: true security_scan: critical_allowed: 0 high_allowed: 0 dependency_vulnerabilities: critical_allowed: 0 high_allowed: 0
| ID | Location | Type | Severity | Effort | Discovered | Owner | Status |
|---|---|---|---|---|---|---|---|
| TD-001 | src/auth/login.ts | Duplication | Medium | 2d | 2025-01-15 | @alice | In progress |
| TD-002 | api/legacy/v1 | Deprecated API | High | 5d | 2025-02-01 | @bob | Backlogged |
| TD-003 | db/migrations | Dead code | Low | 0.5d | 2025-02-10 | @charlie | Fixed |
| Anti-Pattern | Symptom | Solution |
|---|---|---|
| Gate for the sake of gate | Blocked PRs on non-issues | Each gate must tie to a real quality risk |
| Ignoring tech debt until crisis | Massive refactoring needed | Track and allocate budget, don't let debt accumulate |
| Overly strict lint rules | Format bikeshedding in PR review | Use auto-formatting (prettier, black) consistently |
| Coverage target gaming | Tests that assert nothing but cover lines | Enforce mutation testing or coverage with assertion checks |
| Rotting quality dashboard | No one looks at metrics | Review in retro, alert on threshold breaches |