agentleFS
Sign inStart free
typvtypv/nest-turbo-starter/.claude/skills/quality-gates/SKILL.md

quality-gates

Skill224 starsChanged 3 months agoMITView on GitHub

Run security and quality gates (secrets, SAST, deps, DAST, coverage, file-size) for any project. CI/CD-ready. Use before code review or push.

  • Installs packages

We split this skill into the rules it gives an agent

4 rules. 0 are common, 0 are distinctive, and 4 are very specific to this project.

  • 0

    Common

    Most of the 21 edited versions we read keep these.

  • 0

    Distinctive

    This author's own choices. Worth a look.

  • 4

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    If invoked without arguments, use AskUserQuestion:

    line 13
  2. Very specific:

    When /quality-gates setup is invoked:

    line 39
  3. Very specific:

    /code-review: Run gates first, feed latest-report.md into review context

    line 118
  4. Very specific:

    /cook: Run gates before code review gate

    line 119

“Common” is measured: kept by at least 6 in 10 of the 21 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Quality Gates

Language-agnostic security and quality scanning. Wraps gitleaks, trivy, semgrep, nuclei, SonarQube, and file-size checks.

Default (No Arguments)

If invoked without arguments, use AskUserQuestion:

OptionDescription
setupClaude wizard — reads docs, generates config, guides install
runRun all applicable gates
reportGenerate markdown report from last run

Present via AskUserQuestion with header "Quality Gates", question "What would you like to do?".

Commands

CommandScriptDescription
/quality-gates setupwizard (Claude)Full setup wizard — Load references/setup-wizard.md
/quality-gates runrun-all.shRun all gates (blocked if setup incomplete)
/quality-gates run --check <gate>run-all.shRun one gate only
/quality-gates run --no-blockrun-all.shPrint findings, always exit 0
/quality-gates run --jsonrun-all.shMachine-readable JSON summary
/quality-gates run --mode <mode>run-all.shForce run mode (pre-commit/pre-push/pr/ci/diff/full)
/quality-gates reportreport.shGenerate markdown report from gate outputs

Setup guard: run is blocked if .quality-gates/config.yaml is missing or required tools not installed. Use --no-block to override.

Setup Wizard

When /quality-gates setup is invoked:

Load references/setup-wizard.md and follow ALL steps in order.

Steps overview:

  1. Read project context — check docs/ first, ask user if missing [BLOCKING]
  2. Ask optional gates — SonarQube, DAST (tags + blocking threshold), hooks [BLOCKING]
  3. Confirm with user — show full config summary [BLOCKING]
  4. Generate config — run generate-config.sh
  5. Setup validation — run setup-all.sh --json
  6. Install guidance — per missing tool
  7. Summary — print final status

Gate Reference

GateToolBlock conditionScope
secretsgitleaksexit 1 alwaysstaged / diff / full history
depstrivyexit 1 on CRITICAL, exit 2 on HIGHlockfiles only
sastsemgrepexit 1 on ERROR, exit 2 on WARNINGdiff-aware (BASE_SHA)
dastnucleiexit 1 at block_severity threshold, exit 2 belowendpoints.txt (CI-only by default)
coveragebash/jqexit 1 if below thresholdcoverage report files
file-sizetokei/wcexit 2 only (warn, never block)all dirs (scope.exclude applied)
sonarsonar-scannerexit 1 if gate FAILEDfull project (PR decoration: Developer Edition+)

Exit Codes

CodeMeaning
0Pass
1Hard block (error)
2Warn only (non-blocking)
3Tool not installed
4Skipped (condition not met)

Run Modes

Auto-detected. Override with QUALITY_GATES_MODE=<mode> or --mode <mode>.

ModeAuto-detected whenScan scope
pre-commitQUALITY_GATES_SCOPE=pre-commitstaged files only
pre-pushQUALITY_GATES_SCOPE=pre-pushupstream tracking branch
prCI + PR env vars (GITHUB_BASE_REF etc.)merge-base with PR target
ciCI env set, no PRfull scan
difflocal defaultmerge-base with origin/main
fullQUALITY_GATES_MODE=fullfull scan

Override baseline: BASE_SHA=<sha> /quality-gates run

Output Format

🔍 Running Quality Gates...

[secrets]    ✅ gitleaks: no secrets found
[deps]       ⚠️  trivy: not installed → brew install trivy
[sast]       ❌ semgrep: 2 ERROR findings → .quality-gates/reports/raw/20260329-181500/sast-report.json
[file-size]  ⚠️  3 files exceed 200 LOC
[coverage]   ✅ 78% (threshold: 70%)
[sonar]      ℹ️  Skipped (SONAR_HOST_URL not set)
[dast]       ℹ️  Skipped (CI only)

────────────────────────────────
Summary: 1 error, 2 warnings, 2 skipped

Configuration

Config: .quality-gates/config.yaml (created by setup wizard). Template: .claude/skills/quality-gates/templates/quality-gates-config.yaml.

Key fields: scope.exclude, thresholds.coverage, thresholds.file_max_loc, dast.tags, dast.block_severity, gates.<name>.enabled.

Integration

  • Pre-commit: secrets check only (fast, hard block)
  • Pre-push: secrets + sast + deps (via QUALITY_GATES_SCOPE=pre-push)
  • CI pipeline: Full run including DAST + SonarQube
  • /code-review: Run gates first, feed latest-report.md into review context
  • /cook: Run gates before code review gate

References

FilePurpose
references/setup-wizard.mdFull 9-step wizard execution (load when running setup)
references/archetype-table.mdArchetype presets + customization signals + SonarQube profiles
references/nuclei-templates-catalog.mdSignal → nuclei tags/profiles
references/sonar-properties-reference.mdPer-stack sonar-project.properties
references/gitleaks-rules-reference.mdCustom gitleaks rules + allowlists

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free