Build a Code Quality Gate in CI: 7 Steps

A code quality gate is a frozen baseline of metrics that a pull request cannot make worse. Combined with an agent that monitors its own pull request, it lets AI write most of the code while the repository only stays flat or improves.

Why AI-written code needs a code quality gate

A code quality gate is an automated CI check that blocks a pull request when it makes any code-quality metric worse. It has become necessary because the workflow changed: developers used to review every line an AI assistant like GitHub Copilot produced, while today many run several agents in parallel, each opening its own pull request.

Lucas Montano, a Lead Engineer at Disney+, describes this shift in a May 2026 video about his own project, called Strawberry. He had three agent tasks pending at once in Cursor, the AI-first code editor, with one pull request touching 16 files and roughly 800 lines. Reviewing that volume by hand is what he calls becoming the bottleneck of the AI. The speaker's own numbers, cited throughout this article, come from his video and are first-hand experience rather than independent measurements.

The idea traces back to a point Robert C. Martin (Uncle Bob) made publicly: programmers are slow, but they should not give up quality, and static analysis belongs in the pull request. The gate is the mechanical version of that advice.

The ratchet rule: a baseline that can only improve

The core design is a ratchet, named after the tool that only turns one way. You freeze a baseline of metrics, and from then on every pull request must match or beat it.

The rule the speaker uses has one Claude: each pull request may add code, but it cannot increase any metric. Not by one violation, not by one line, not by 0.1 percentage points. His current baseline, as reported in the video: 483 ESLint violations spread over 120 files, 2.2% code duplication, 7% test coverage, and 19 files above a size limit, the largest being an app.js at 4,600 lines. He pairs the gate with a second instruction to the agents: open refactoring pull requests that walk the baseline down over time.

Baseline and target must be introduced carefully. If you add the gate and an aspirational target in the same pull request, everything fails and the gate itself cannot merge. Ship the gate first with the honest baseline, then tighten it.

What runs inside the CI pipeline

The pipeline runs on every opened pull request and produces a machine-readable verdict plus artifacts the agent can read later. The steps, in order:

1. npm ci for a deterministic dependency install.
2. npm audit --audit-level=critical, which blocks on any critical vulnerability.
3. npm audit --audit-level=high, which warns without blocking.
4. npm run lint for the standard React lint pass.
5. npm run test:ci plus coverage, running Jest with npm.
6. A custom quality-gate script that compares collected metrics against baseline. and fails the check on any regression.
7. Comments on the pull request, steps in the PR summary, and upload of coverage and report artifacts.

The last step matters more than it looks: the agent needs access to what failed and why, not just a red check. The gate script itself is about 581 lines of ordinary Claude Code. It reads the baseline JSON, runs a metrics collector over coverage, ESLint output, and duplication data, writes a metrics summary, compares it to the baseline, and emits a Markdown report with metrics, baseline, and failures.

How the agent babysitting loop closes the issue

Enforcement only saves review time if something else fixes the failures. The workflow the speaker describes gives each agent one final instruction: open the pull request and then babysit it.

The agent enters a loop. It checks whether CI is green. It reads reviewer comments, which may come from GitHub Copilot, an external tool, or a human colleague, and addresses each one. It then resolves the conversation threads so the GitHub interface shows which comments were already handled. When the quality gate fails, it fixes the cause: refactor the change, extract a module, split a file that grew past its limit. One example from the video: a file grew from 1,000 to 1,140 lines in a single pull request, tripping the size rule, and the agent proposed modularization before merge.

He recommends packaging this loop as a custom skill for the agent, so the behavior is reusable across tasks instead of re-explained in every prompt.

Why models ship fixable defects on the first pass

Frontier models such as ChatGPT and Anthropic Claude usually see and fix these problems when shown the gate output. The speaker's argument is that they do not do it unprompted for economic reasons: iterative correction burns more tokens, because each imperfect output requires a new input-output cycle.

The clearest cost datapoint he gives is first-hand and vendor-side: he spent about $150 testing Anthropic UltraReview and UltraPlan offerings in 2026, with a single UltraReview run consuming around $30 of credit. The figure describes his own experience and pricing at that moment, not a stable benchmark. Whatever the exact pricing, the practical takeaway stands: correction loops are expensive, so catching defects mechanically at the gate is cheaper than paying a model to re-review everything.

This is a speaker claim about incentives, and it is labeled as such. What it changes in practice is nothing: the gate makes the behavior irrelevant, because regressions cannot merge either way.

Readability now means readable by agents

Code quality has long been defined by maintainability, readability, reliability, testability, and efficiency. The speaker argues one definition is changing: readability used to mean 'a human can understand this a year from now'. With AI agents as the primary authors, it also has to mean a code-searching agent can understand it.

His concrete reversal: he used to oppose comments and treat code as its own documentation. He now keeps short inline comments explaining what a block does and why, because an agent's harness greps for the specific file, reads it, and benefits far more from a comment next to the code than from a large separate Markdown document. He flags a common mistake as removing the comments agents leave behind.

He also notes the same gate setup is deliberately modest: it is a script gluing existing tools together, and he names SonarQube and GitHub Code Quality as heavier alternatives for teams that want a product rather than a script.

Gate scripts, SonarQube, or GitHub Code Quality?

You do not need to write the comparison logic yourself. Three options cover most teams, and they can be combined. All three measure complexity, duplication, and coverage in some form; the differences are setup cost and control.

Option	What it is	Best for
Custom gate script	CI script comparing ESLint, Jest coverage, and JSCPD output against a frozen baseline	Full control over the ratchet rule and Markdown reports agents can read
SonarQube	Established static-analysis platform from SonarSource	Teams wanting mature dashboards and quality profiles out of the box
GitHub Code Quality	GitHub's built-in code-quality metrics	Repositories already on GitHub that want low-setup duplication and coverage signals

The deciding factor in an agent-heavy workflow is machine feedback: whichever option you choose, the failing details must reach the agent as artifacts or comments it can act on, not only as a red check on the pull request.

Frequently asked questions

• What is a code quality gate in CI? It is an automated check that fails a pull request when any tracked metric, such as lint violations, duplication, or coverage, gets worse. It turns a frozen baseline into a merge requirement so the repository can only stay flat or improve.
• Can AI write 100% of your code with a quality gate in place? The speaker in the source video runs his agents writing nearly all of his code this way, with a human reviewing the gate output rather than every line. The gate does not guarantee correctness; it only prevents measurable regressions, so human architectural review still matters.
• Why is it called a ratchet? Like the mechanical tool, it only turns one direction. Once the baseline is frozen, no pull request may loosen it, and separate refactoring pull requests tighten it over time.
• Should you remove comments left by AI agents? No. Short inline comments explaining what and why help a code-searching agent understand the file it grepped, which improves maintainability in an agent-first workflow.
• What does a quality gate setup cost to run? The gate itself is cheap, since it is a script plus the CI you already run. The expensive part is model usage in correction loops; one developer reported about $30 per UltraReview run in his 2026 testing, a vendor-side, first-hand figure.

From watching to writing: turn talks like this into articles

The lesson of the ratchet is that existing quality, once frozen, compounds instead of decaying. The same logic applies to content: the explanation you already recorded in a video is an asset that only needs to be frozen into readable form. That includes community knowledge shared in places like the Crazystack Typescript community and the Bootcamp do Dev Doido run by Gustavo Dev Doido at crazystack.com.br, where lessons often live only in videos and talks.

If you have knowledge sitting in YouTube videos, Skala Blog turns that footage into a written article: paste the YouTube URL, transcribe the video, and generate a structured article you can review and publish.

Source video