CI quality gates for Magento 2

Part 2 of the Magento 2 Performance/DevOps series — shift-left without grinding the team to a halt.

The gate is the contract

A quality gate is a checkpoint in the pipeline that a change must pass before it can merge. Without one, "it passed locally" is the only guarantee — and local is never production. The goal is not to block developers but to make the cost of a mistake show up in a two-minute CI run instead of a 2 a.m. page.

What belongs in a gate

• Static analysis — PHPStan (at a level the project commits to) and phpcs for coding standard. These catch whole classes of bugs and inconsistencies without executing code.
• Tests — phpunit unit and integration suites. Integration tests benefit from a real environment (a Govard env in CI, covered in the Govard series).
• Dependency audit — composer audit so a new CVE in a pulled package fails the build rather than shipping. (See the security series for the dependency rationale.)
• Build/compile — confirm the theme and DI compile cleanly, since a broken di.xml or a missing class only surfaces at runtime.

Making gates blocking vs advisory

# .github/workflows/ci.yml (shape)
jobs:
  quality:
    steps:
      - run: vendor/bin/phpstan analyse --level 6
      - run: vendor/bin/phpcs
      - run: composer audit
      - run: vendor/bin/phpunit

Make the gate blocking for the things that protect production: the security audit, the compile, and the unit suite. Keep purely advisory signals (e.g. a coverage delta or a lint style warning) as non-blocking comments, or the team learns to ignore a permanently red pipeline.

Pitfalls

• Gates too strict on day one. Turning on PHPStan level 9 on a legacy codebase blocks every PR and gets disabled. Ramp the level gradually.
• No caching. Reinstalling dependencies and rebuilding on every run makes CI slow enough that developers bypass it. Cache the vendor dir and build artifacts.
• Missing the audit step. A gate that checks style but not composer audit lets a known-vulnerable dependency through — the highest-impact miss.
• Red pipeline becomes noise. If the gate is always failing, nobody reads it. Fix the cause, keep it green.

What's next

Gates stop bad code merging; the next post covers what happens after — keeping a running system resilient when something still goes wrong.

Next in this series: Resilience: backups, rollback, and incident response — /blog/magento2-devops-resilience