GitHub Checks & Rules

Quality, security, and styling standards are automatically enforced on every pull request. These checks ensure that no vulnerable, broken, or improperly styled code reaches our shared environments.

Automated GitHub Checks

The following checks run on every pull request targeting alpha, beta, or prod branches. A PR cannot be merged if any required check is failing.

Code Quality & Security

Check	Tool / Engine	Purpose	Enforced?
SonarQube Check	SonarQube / SonarCloud	Analyzes source code for bugs, code smells, vulnerabilities, and maintainability issues. Enforces team coding standards.	Yes
Git Leak Check	Gitleaks / custom scanner	Scans commits for exposed secrets (API keys, credentials, tokens). Blocks merges if secrets are committed.	Yes
NPM Audit Check	npm audit / pnpm audit	Scans node dependencies for known vulnerabilities against the npm registry database.	Yes
NPM License Check	License Checker	Verifies that all dependencies comply with permitted open-source licenses to avoid legal risks.	Yes
Docker Image Scan	Trivy / Snyk	Scans container images for vulnerabilities, outdated system packages, and misconfigurations.	Yes

Build & Style Compliance

Check	Tool / Engine	Purpose	Enforced?
Build Check	Next.js / Angular compiler / Vite	Verifies that the codebase compiles and packages successfully without syntax or module resolution errors.	Yes
Linting Check	ESLint & Prettier	Enforces styling guidelines and coding patterns. Catches syntax, unused variables, and format issues.	Yes
Terraform Format	terraform fmt -check	Ensures Terraform files conform to standard formatting layout.	Yes
Terraform Validation	terraform validate	Verifies syntactic correctness and logical validity of Terraform definitions.	Yes

---

SonarQube Quality Gate

The SonarQube check enforces a Quality Gate — a set of conditions the code must meet before it can qualify for release. It answers one question: can this code be promoted in its current state? By enforcing quality on new code while gradually fixing existing issues, the codebase improves over time (the "leak period" model).

We use the default (Sonar way) Quality Gate, which flags code as failed if any of the following are true on new code:

Condition	Failure threshold (new code)
Coverage	Less than 80%
Duplicated lines	Greater than 3%
Maintainability rating	Worse than A
Reliability rating	Worse than A (any bugs)
Security rating	Worse than A (any vulnerabilities)

---

Branch Protection Rules (GitHub Rule Sets)

To protect critical branches (main, production), we enforce the following rules via GitHub Rule Sets.

Protected Branch Rules

• Require pull requests before merging: All code changes must go through a pull request. Direct pushes are blocked.
• Restrict direct pushes: Direct commits cannot be written to protected branches.
• Enforce linear history: Merge commits are restricted (squash merges only) to keep a clean, readable Git history.
• Prevent force pushes and deletions: Protects history integrity and prevents accidental deletion of main branches.

Required Status Checks

PRs cannot merge until these specific pipeline status checks pass:

• SonarQube Check
• Terraform Validate & Plan
• NPM Audit Check
• Build Check
• Lint Check

Pull Request Review Rules

• Require approvals: A minimum of 1–2 approvals from other engineers is required.
• Require review from code owners: Reviews must include sign-off from designated owners defined in the CODEOWNERS file.
• Dismiss stale approvals: Approvals are automatically reset when new commits are pushed to the PR branch.
• Require conversation resolution: All comments, questions, and feedback must be resolved before merging.

Advanced Quality Gates

• Required Deployment Check: A successful deployment to the staging/alpha preview environment must be completed before merging is allowed.
• Copilot Review Check: Automated Copilot review scans code changes for potential bugs and recommends code structure improvements.
• Dependabot Check: Dependabot monitors and raises automated PRs for outdated or vulnerable packages.