CI/CD Guardrails: Quality Gates and Policy Enforcement

# .github/workflows/ai-code-quality.yml
name: AI Code Quality Pipeline

on:
  pull_request:
    branches: [main, develop]

jobs:
  # L2: Quick PR checks
  quick-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Secret Detection
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

      - name: Lint and Format Check
        run: |
          pip install ruff
          ruff check src/ --output-format=github
          ruff format src/ --check

      - name: Unit Tests with Coverage
        run: |
          pytest tests/ --cov=src --cov-report=xml \
                 --cov-fail-under=75

  # L3: Deep analysis
  deep-analysis:
    needs: quick-checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: SonarQube Analysis
        uses: sonarsource/sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

      - name: Quality Gate Check
        uses: sonarsource/sonarqube-quality-gate-action@master
        timeout-minutes: 5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: Dependency Security Scan
        uses: snyk/actions/python@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: SAST with Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/python
            p/security-audit
            p/owasp-top-ten
      

// Quality Gate "AI Code Strict" - SonarQube Configuration
{
  "name": "AI Code Strict",
  "conditions": [
    {
      "metric": "new_coverage",
      "op": "LT",
      "error": "75",
      "warning": "80"
    },
    {
      "metric": "new_duplicated_lines_density",
      "op": "GT",
      "error": "5",
      "warning": "3"
    },
    {
      "metric": "new_maintainability_rating",
      "op": "GT",
      "error": "1"
    },
    {
      "metric": "new_reliability_rating",
      "op": "GT",
      "error": "1"
    },
    {
      "metric": "new_security_rating",
      "op": "GT",
      "error": "1"
    },
    {
      "metric": "new_security_hotspots_reviewed",
      "op": "LT",
      "error": "100"
    },
    {
      "metric": "new_cognitive_complexity",
      "op": "GT",
      "error": "10"
    }
  ]
}
      

# OPA Policy for AI code quality (Rego language)
# policies/ai_code_quality.rego

package ai_code_quality

# Rule: block merge if coverage is below threshold
deny[msg] {
    input.coverage.new_code < 75
    msg := sprintf("Insufficient coverage: %v%% (minimum 75%%)",
                   [input.coverage.new_code])
}

# Rule: block merge if there are critical vulnerabilities
deny[msg] {
    vuln := input.security.vulnerabilities[_]
    vuln.severity == "CRITICAL"
    msg := sprintf("Critical vulnerability: %s (CWE-%s)",
                   [vuln.description, vuln.cwe])
}

# Rule: block merge if cognitive complexity is too high
deny[msg] {
    func := input.complexity.functions[_]
    func.cognitive_complexity > 15
    msg := sprintf("Cognitive complexity too high in %s: %v (max 15)",
                   [func.name, func.cognitive_complexity])
}

# Rule: block merge if hardcoded secrets found
deny[msg] {
    secret := input.secrets[_]
    msg := sprintf("Hardcoded secret found: %s at line %v",
                   [secret.type, secret.line])
}

# Rule: warning if duplication above threshold
warn[msg] {
    input.duplication.new_code > 3
    msg := sprintf("Duplication at %v%% (warning threshold: 3%%)",
                   [input.duplication.new_code])
}

# Final decision
allow {
    count(deny) == 0
}
      

# Feedback system for quality gate failures
class QualityGateFeedback:
    """Generates actionable feedback for quality gate failures"""

    def generate_pr_comment(self, gate_results):
        """Generates a PR comment with failure details"""
        sections = []

        if gate_results["coverage"]["failed"]:
            sections.append(self._coverage_feedback(gate_results["coverage"]))

        if gate_results["security"]["failed"]:
            sections.append(self._security_feedback(gate_results["security"]))

        if gate_results["complexity"]["failed"]:
            sections.append(self._complexity_feedback(gate_results["complexity"]))

        return {
            "title": "Quality Gate: FAILED",
            "summary": f"{len(sections)} issues to resolve before merge",
            "sections": sections,
            "auto_suggestions": self._generate_fix_suggestions(gate_results)
        }

    def _coverage_feedback(self, coverage_data):
        return {
            "title": "Insufficient Coverage",
            "current": f"{coverage_data['actual']}%",
            "required": f"{coverage_data['threshold']}%",
            "uncovered_files": coverage_data["uncovered_files"],
            "action": "Add tests for the files listed above, "
                      "focusing on error paths and edge cases"
        }

    def _generate_fix_suggestions(self, results):
        """Generates automatic fix suggestions"""
        suggestions = []
        for issue in results.get("issues", []):
            if issue["type"] == "hardcoded_secret":
                suggestions.append(
                    f"Line {issue['line']}: replace with "
                    f"os.getenv('{issue['suggested_env_var']}')"
                )
            elif issue["type"] == "high_complexity":
                suggestions.append(
                    f"Function {issue['function']}: "
                    f"decompose into smaller functions"
                )
        return suggestions