Building an AI Code Quality Gate for Your CI/CD Pipeline

# .github/workflows/ai-quality-gate.yml
name: AI Code Quality Gate

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  static-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check for new dependencies
        run: |
          DIFF=$(git diff origin/main -- package.json)
          if echo "$DIFF" | grep -q '"dependencies"\|"devDependencies"'; then
            NEW_DEPS=$(echo "$DIFF" | grep "^+" | grep -v "^+++" | grep '"')
            echo "::warning::New dependencies detected. Review required."
            echo "$NEW_DEPS"
            echo "new_deps=true" >> $GITHUB_OUTPUT
          fi

      - name: Scan for placeholder values
        run: |
          grep -rn "example\.com\|TODO\|FIXME\|CHANGEME\|your-.*-here\|xxx\|placeholder" \
            --include="*.ts" --include="*.tsx" --include="*.js" \
            src/ && echo "::error::Placeholder values found in source code" && exit 1 || true

      - name: Check for console.log in production code
        run: |
          LOGS=$(grep -rn "console\.log" --include="*.ts" --include="*.tsx" src/ \
            | grep -v "test\|spec\|__test__\|mock" | wc -l)
          if [ "$LOGS" -gt 0 ]; then
            echo "::warning::Found $LOGS console.log statements in production code"
          fi

// scripts/ai-quality/context-check.ts
import { Project, SyntaxKind } from "ts-morph";

interface PatternViolation {
  file: string;
  line: number;
  rule: string;
  message: string;
  severity: "error" | "warning";
}

export function checkPatternConformance(
  changedFiles: string[]
): PatternViolation[] {
  const project = new Project({
    tsConfigFilePath: "./tsconfig.json",
  });
  const violations: PatternViolation[] = [];

  for (const filePath of changedFiles) {
    const sourceFile = project.getSourceFile(filePath);
    if (!sourceFile) continue;

    // Rule 1: No class-based services (we use functions)
    const classes = sourceFile.getClasses();
    for (const cls of classes) {
      if (cls.getName()?.endsWith("Service") ||
          cls.getName()?.endsWith("Repository")) {
        violations.push({
          file: filePath,
          line: cls.getStartLineNumber(),
          rule: "no-class-services",
          message: `Class "${cls.getName()}" uses class pattern. ` +
                   `This codebase uses functional pattern for services.`,
          severity: "error",
        });
      }
    }

    // Rule 2: Error handling must use Result pattern
    const tryCatches = sourceFile.getDescendantsOfKind(
      SyntaxKind.TryStatement
    );
    for (const tc of tryCatches) {
      const catchBlock = tc.getCatchClause();
      if (catchBlock) {
        const body = catchBlock.getBlock().getText();
        if (body.includes("console.error") && !body.includes("Result")) {
          violations.push({
            file: filePath,
            line: tc.getStartLineNumber(),
            rule: "use-result-pattern",
            message: "Try/catch swallows error. Use Result<T, E> pattern.",
            severity: "error",
          });
        }
      }
    }

    // Rule 3: No direct fetch calls (use our httpClient)
    const callExpressions = sourceFile.getDescendantsOfKind(
      SyntaxKind.CallExpression
    );
    for (const call of callExpressions) {
      const text = call.getExpression().getText();
      if (text === "fetch" || text === "axios.get" ||
          text === "axios.post") {
        violations.push({
          file: filePath,
          line: call.getStartLineNumber(),
          rule: "use-http-client",
          message: "Direct fetch/axios call. Use httpClient from @/lib/http.",
          severity: "error",
        });
      }
    }
  }

  return violations;
}

// scripts/ai-quality/deep-analysis.ts
import { readFileSync } from "fs";

interface AnalysisConfig {
  architectureDoc: string;
  changedFiles: string[];
  existingPatterns: string[];
}

export async function runDeepAnalysis(config: AnalysisConfig) {
  const architectureContext = readFileSync(
    config.architectureDoc,
    "utf-8"
  );

  const prompt = `You are a code reviewer for our codebase.
Our architecture rules:
${architectureContext}

Review these changes for:
1. Pattern violations not caught by static analysis
2. Security issues (auth, input validation, data exposure)
3. Performance concerns (N+1 queries, missing indexes)
4. Test coverage gaps (untested edge cases)

For each issue, provide:
- File and line number
- Severity (critical/warning/info)
- Specific fix recommendation

Changed files:
${config.changedFiles.map(f =>
  `--- ${f} ---\n${readFileSync(f, "utf-8")}`
).join("\n\n")}

Respond in JSON format only.`;

  // Call your preferred AI API here
  const response = await callAIReview(prompt);
  return JSON.parse(response);
}

// scripts/ai-quality/report.ts
interface QualityReport {
  staticChecks: { passed: boolean; warnings: number; errors: number };
  patternViolations: PatternViolation[];
  deepAnalysis: AnalysisResult[];
  overallScore: number;
  recommendation: "approve" | "review" | "block";
}

export function generateReport(report: QualityReport): string {
  const emoji = report.recommendation === "approve" ? "pass" :
                report.recommendation === "review" ? "warn" : "fail";

  let markdown = `## AI Code Quality Report\n\n`;
  markdown += `**Overall Score:** ${report.overallScore}/100\n`;
  markdown += `**Recommendation:** ${report.recommendation}\n\n`;

  if (report.patternViolations.length > 0) {
    markdown += `### Pattern Violations\n`;
    for (const v of report.patternViolations) {
      markdown += `- **${v.file}:${v.line}** - ${v.message}\n`;
    }
  }

  if (report.deepAnalysis.length > 0) {
    markdown += `### Deep Analysis Findings\n`;
    for (const finding of report.deepAnalysis) {
      markdown += `- [${finding.severity}] ${finding.message}\n`;
    }
  }

  return markdown;
}

name: AI Code Quality Gate
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-quality:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: "20"

      - run: npm ci

      - name: Get changed files
        id: changed
        run: |
          FILES=$(git diff --name-only origin/main -- '*.ts' '*.tsx')
          echo "files=$FILES" >> $GITHUB_OUTPUT

      - name: Run Static Checks
        run: npx tsx scripts/ai-quality/static-checks.ts

      - name: Run Pattern Check
        run: npx tsx scripts/ai-quality/context-check.ts

      - name: Run Deep Analysis
        if: github.event.pull_request.draft == false
        run: npx tsx scripts/ai-quality/deep-analysis.ts
        env:
          AI_API_KEY: ${{ secrets.AI_REVIEW_KEY }}

      - name: Post Report
        uses: actions/github-script@v7
        with:
          script: |
            const report = require('./ai-quality-report.json');
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: report.markdown
            });