# Run Quality Gates Before Shipping Code

Manual pre-release checks are inconsistent and easy to miss. This skill detects project tooling, runs staged quality gates, and reports actionable failures.

## Install

```bash
npx skillstore add ai-vibe-prompts/atman36-quality-gates
```

## Metadata

- Status: approved
- Slug: atman36-quality-gates
- Version: 1.0.0
- Author version: 1.0.0
- Skillstore revision: r2
- Version status: valid
- Tree hash: 380f0cebf1c6d4ae1c5f2c74ac9eb370699536c589b3e68ef753e22fadbbbdc7
- Author: AI-Vibe-Prompts
- GitHub username: Atman36
- License: MIT
- Repository: https://github.com/Atman36/AI-Vibe-Prompts/tree/main/.claude/skills/core/quality-gates
- Ref: 89edfdc710d0846129dcee6a929477b04f08052c
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem
- Quality score: 50
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/atman36-quality-gates
- Manifest: https://skillstore.pages.dev/api/skills/atman36-quality-gates/manifest

## Capabilities

- Detects ESLint, Biome, TypeScript, Vitest, Jest, Node tests, and common build tools from project files.
- Runs linting, type checks, tests, builds, dependency audits, and optional complexity checks.
- Supports pre-commit, pre-push, and pre-deploy gate levels with different validation depth.
- Summarizes exit status, failures, coverage, and file locations in a structured quality report.
- Checks staged changes for likely secrets, environment files, and oversized files.
- Suggests targeted fixes and Husky integration when checks fail.

## Use Cases

- Validate a Local Change: Run fast linting and type checks before creating a commit, then receive focused correction steps.
- Review a Pull Request: Run tests, coverage, builds, and dependency audits before approving a merge or release.
- Define Deployment Gates: Apply configured thresholds and produce a clear pass, fail, or skipped result for each deployment check.

## Prompt Templates

### Run Fast Checks

```
Run the fastest quality gates for this project. Detect available tools, ask before executing commands, and summarize each result.
```

### Validate Before Push

```
Run pre-push quality gates. Include linting, type checks, unit tests, and dependency audit. Stop on failure and report exact next steps.
```

### Check Deployment Readiness

```
Validate this project for deployment using configured thresholds. Run the build, tests, coverage, dependency audit, and relevant complexity checks. Do not modify files.
```

### Plan Selective Gates

```
Design a selective quality-gate run for staged changes. Explain chosen gates, request approval, execute approved checks, redact sensitive matches, and provide a release decision.
```

## Limitations

- Focuses on JavaScript, TypeScript, and Node package workflows; other ecosystems require adaptation.
- Depends on project scripts and installed tools; missing or incorrect configuration can prevent checks.
- Command execution can run repository-controlled scripts and may change files when fix modes are used.
- Pattern-based secret and complexity checks can miss issues or produce false positives.

## Best Practices

- Review detected tools and commands before execution, especially in an unfamiliar repository.
- Use project-defined thresholds and keep the default validation path read-only.
- Redact sensitive matches and report enough location detail for safe remediation.

## Anti Patterns

- Do not run forced dependency updates as part of a routine quality check.
- Do not bypass failed hooks or gates without documented approval and follow-up.
- Do not treat grep-based secret or complexity checks as complete security analysis.

## Security Audit

- Audited at: 2026-07-23T07:33:00.484\+00:00
- Summary: All 78 static findings are false positives because the scanner primarily interpreted Markdown backticks and fenced examples as Ruby execution. The shell substitution, xargs, environment-file, hidden-file, and network alerts also lack the claimed behavior in context. Three semantic risks remain: automatic repository command execution, unconfirmed mutating or bypass operations, and unredacted secret matches.

## Stats

- Views: 195
- Downloads: 10
- Favorites: 0
- Popularity score: 0