Quality and release gates
Design and implement quality and release gates
Gates live at two different boundaries, and confusing them is the usual mistake.
| Boundary | Mechanism | Owner |
|---|---|---|
| Pull-request completion into a branch | Branch policies | Project Administrators or users with repository-level Edit policies permission |
| Use of a protected resource | Approvals and checks | Resource owner |
Branch policies — the merge gate
Applied to a protected branch, these can require: a minimum number of reviewers, linked work items, resolved comments, successful build validation, and successful status checks from external services. They enforce those requirements before a pull request completes.
What they cannot do is govern deployment. A branch policy has no opinion about whether a release may reach production.
Checks — the protected-resource gate
Configured by the owner of an environment, service connection, repository, agent pool, variable group, or secure file. Because the resource owner sets them outside pipeline YAML, a central team can impose a control on any stage that consumes the protected resource.
The security-and-governance examples worth naming:
- Required template — requires pipelines that use the protected resource or environment to extend the specified template.
- Branch control — checks the branches of all linked resources against the allowed list and can require branch protection.
- Query Azure Monitor alerts — succeeds when no queried alert rules are active at evaluation time.
- Evaluate artifact — applies custom policy to artifact metadata; it currently supports container image artifacts only.
Shift left, but keep the gate
Fast feedback in the PR is cheaper than a failed release, so run unit tests, linting and dependency scanning at the merge boundary. Keep protected-resource checks as well. A configured branch policy enforces its PR requirements; configured checks enforce whether a stage may consume a protected resource. Neither mechanism proves general code quality by itself.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies
- https://learn.microsoft.com/en-us/azure/devops/pipelines/process/approvals
- https://learn.microsoft.com/en-us/azure/devops/pipelines/process/resources