Keep the blocking gates few, automated and agreed in advance. Typical candidates are passing unit and integration tests, a passing smoke suite on the deployed build, no new critical security findings, coverage on changed code, performance thresholds (a k6 run fails the pipeline on a breached threshold), and contract checks such as can-i-deploy. Google's guidance is to gate on new code or coverage deltas rather than a global number, and warns that a target can become a checkbox; it also says the level is a business decision for the product owners. DORA metrics such as change failure rate are better as health indicators than as hard gates, because teams game any single metric.

Tools such as SonarQube can enforce the coverage-on-new-code rule as a pipeline gate.

Sources: Google Testing Blog, Grafana k6 course, DORA metrics, SonarQube quality gates