Overview
Every scan produces three letter ratings and a pass/fail quality gate result. Together they turn a pile of raw findings into a decision: is this code good enough to ship? This article explains what the ratings mean, how to read the rating mix, and how the gate reaches Pass or Fail.
The three ratings
Each scan is graded on three independent axes, from A (best) to E (worst):
- Maintainability — how easy the code is to change safely. Driven largely by code smells and duplication. A low grade means future changes will be slow and error-prone.
- Reliability — how likely the code is to behave correctly. Driven by bugs. A low grade means real defects are present.
- Security — how exposed the code is. Driven by vulnerabilities. A low grade means known security weaknesses exist.
Because the three axes are separate, a project can be strong on one and weak on another — for example, Maintainability A but Security D. Read all three; don't average them in your head.
Duplication and the rating mix
Alongside the letters, a scan reports a duplication percentage — how much of the analyzed code is copy-pasted. High duplication drags Maintainability down and is one of the easiest things to fix.
The rating mix on the Quality tab shows how your projects' latest ratings are distributed — for example, how many projects sit at A on Security versus how many are at C or worse. It's a portfolio view: use it to spot which axis needs attention across the whole workspace, not just one repo.
How the quality gate decides
A quality gate is a set of conditions, each comparing one measured metric against a threshold. Typical conditions:
- Security rating must be A.
- Reliability rating must be at least B.
- Duplication must be under 5%.
After a scan measures the metrics, the gate checks each condition and reports Pass only if every condition passes; a single failed condition fails the whole gate. Failed scans feed the Dashboard's Failed gates card. If a project has no custom policy, StretchDev applies the default gate.
Preview a gate without re-scanning
You can check a project's gate against its latest stored scan without running a new scan. On the Quality tab, choose the project and view the gate preview: StretchDev re-evaluates the policy against the most recent scan's metrics and shows which conditions pass and which fail. This is a pure read-only computation — no new scan is written — so it's a safe way to test a policy change. (See Previewing analysis and gates without a new scan.)
Example
The Orders Service project's latest scan reports Maintainability B, Reliability A, Security C, duplication 6%. Its gate requires Security A and duplication under 5%. The preview shows two failed conditions — Security is a C (needs A) and duplication is 6% (needs <5%) — so the gate fails. You address the vulnerability behind the Security grade and extract a duplicated helper, re-scan, and the gate flips to Pass.
Tips
- Map ratings to issue types: to raise Security, close vulnerabilities; to raise Reliability, fix bugs; to raise Maintainability, clear code smells and cut duplication.
- Duplication is usually the cheapest Maintainability win — extract shared code once.
- Use the rating mix to pick a workspace-wide focus for the quarter (e.g., "get every project to Security A").
- Preview gate changes against the latest scan before making a policy stricter, so you know how many projects it will start failing.
FAQ
Do ratings change if I don't re-scan? No. A rating reflects the scan that produced it; connect new code and run a fresh scan to update it.
Can a scan pass the gate but still have issues? Yes. A gate only checks the conditions you set. Low-severity issues can remain while every gate condition still passes.
What if a project has no custom gate? The default gate applies, so every scan still gets a Pass/Fail result.
Was this helpful?
Help us improve this article
Use these controls to share whether this answer solved the issue. Feedback helps prioritize updates to StretchSuite Support.