Merge Gates

A merge gate stops a pull request from merging while Solemly has found a high-severity problem. It takes two steps: tell Solemly to fail its check, then tell your code host to require that check.

1. Turn on blocking in Solemly#

In Repository Settings, turn on Block on high severity for the repository. From then on:

• any CRITICAL or HIGH finding makes Solemly / Review fail, reading Blocking: N high-severity finding(s)
• a CRITICAL or HIGH security finding also makes Solemly / Security fail

With blocking off (the default), the checks always pass and the findings are advice.

2. Require the check on your code host#

GitHub#

1. In the repository, go to Settings → Branches (or Rules → Rulesets) and edit the rule for your main branch.
2. Turn on Require status checks to pass before merging.
3. Search for and add Solemly / Review. Add Solemly / Security too if you want security findings to block on their own.

The check appears in the search once Solemly has reviewed at least one pull request in the repository.

GitLab#

Solemly reports commit statuses on the merge request's pipeline. In Settings → Merge requests → Merge checks, turn on Pipelines must succeed, so a failed Solemly / Review status blocks the merge.

Bitbucket#

In Repository settings → Branch restrictions (or Merge checks), require a minimum number of successful builds with no failed builds. Enforcing merge checks needs a Bitbucket Premium plan; on other plans they're shown as warnings.

How the gate behaves#

• Fix and push. A new commit gets a new review. When it no longer finds high-severity issues, the check passes and the merge unblocks.
• Skipped reviews never block. A commit skipped because of the repository's Review when setting, a paused pull request or plan limits gets a passing status.
• Solemly fails open. If a review can't be completed (Review unavailable) or the change is too large, the check doesn't block the merge, so an outage on our side never stops your team from shipping.
• Acceptance is separate. Solemly / Acceptance fails when a pull request doesn't do everything its Jira ticket asks, whatever the blocking setting. It only blocks a merge if you make it a required check too.

Dismissing a finding#

If a finding is wrong, reply @solemly ignore in its thread. It isn't raised again on that pull request. See PR Commands.