Merge gates
How merge gates review a fix pull request before it merges: the built-in and custom gates, required or advisory, automatic fix rounds and overrides.
Where in the portalOrganization → Merge Gates
Updated View as markdown
On this page
Merge gates are reviews a fix must pass before its pull request can be merged. Everyone in the organization can see the gates; only the owner can change them.
Which gates exist
Kelrova has two built-in gates, Security Review and Code Review. The owner can add instructions to a built-in gate, or create up to 10 custom gates with their own focus. The text of a gate only sets what it looks at. It cannot change the decision rule, in which a critical or high severity finding always rejects.
Custom gates never stand in for Security Review. Keep it on if you want security checked.
What happens on a fix pull request
A fix opens or updates a pull request
Every new version, whether a fix round, a manual push or a branch update, is reviewed again by each gate that is on. Results for older versions are replaced.
Each gate reviews the change
The decision follows the findings. Critical and High reject the change. Medium and Low are shown and never block.
A rejection goes back to the fix
A required gate's findings become the next fix round on the same pull request, up to 2 automatic rounds. After that, reply to the fix yourself or override.
Merge opens
Once every required gate has approved the latest version, the pull request can be merged.
Gate settings
| Setting | What it does |
|---|---|
| Enabled | The gate reviews every fix pull request. Turned off, it never runs. |
| Required or Advisory | A required gate must approve before merge and sends rejections back to the fix. An advisory gate shows its findings and blocks nothing. |
| Can be skipped per fix | Members with Override merge gates may leave the gate out when starting a fix. Turn it off to make the gate unskippable. |
| Review security fixes | Pull requests from Fix it now skip every gate by default, which saves credits. Turn this on for the gates that should review them too. |
Overrides
Members with the Override merge gates permission can merge anyway by writing a reason of at least 10 characters. The override is recorded.
Good to know
- Reviews use credits and wait in your organization's queue like any other job.
- A review that fails for a technical reason can be retried for free.
- Changing a gate's instructions re-runs it on open pull requests and spends credits.
- A new custom gate is created turned off. Its settings page sets Enabled, Required and Can be skipped per fix.
To start a fix, see Go Fix: fix, re-check, ask.