Release Gate Criteria
Document control
| Field | Value |
|---|---|
| Owner | Ron Benisty — CTO & CSO (ron.b@iontwrks.com) |
| Status | Approved |
| Version | 1.0 |
| Classification | Confidential |
| Approved by | Ron Benisty — CTO & CSO |
| Approval date | 2026-05-26 (Tuesday) |
| Last reviewed | 2026-05-26 |
| Review cycle | Annual — next review due May 2027 |
| Parent policy | Secure SDLC (SSDLC) |
Satisfies NIST SSDF PO.4 (define and use criteria for software security checks); supports SOC 2 CC8.1 (change management) and ISO/IEC 27001:2022 A.8.29 (security testing in dev & acceptance). Codifies the implicit gates already implemented in Supply Chain & CI/CD Security as a named, version-controlled "definition of done."
1. Purpose
Make it explicit — for any developer, reviewer, or auditor — exactly what must be true for a change to advance from a draft branch into nonprod, and from nonprod into production. Removes the "is this ready to merge?" ambiguity at every stage.
2. The two gates
Gate 1 — Pull-Request gate (must pass before merge to develop)
A PR may be merged only when all of the following are green:
| Check | Tool | Blocking |
|---|---|---|
Branch protection — direct push to main/develop is blocked | GitHub | Yes |
| Secrets at push | GitHub Push Protection | Yes |
| Secret scan (CI) — verified secrets only | TruffleHog --only-verified | Yes |
| Dependency vulnerability scan — no high/critical | OSV-Scanner | Yes |
| Container image scan — no high/critical CVEs | Trivy | Yes |
| SAST — no high findings | Semgrep OSS | Yes |
| Workflow security analysis | zizmor + actionlint | Yes |
| Lockfile integrity + no postinstall execution | npm ci --ignore-scripts | Yes |
| Lint | ESLint + security plugins | Yes |
| Unit + integration tests | Project test suite | Yes |
| Cross-tenant isolation tests | Project test suite (Multi-Tenancy) | Yes |
| Coverage thresholds met per Secure Coding Standard §3.15 | Vitest + @vitest/coverage-v8 | Yes |
| Container build + Trivy image scan | GitHub Actions | Yes |
| Install-time malicious-package block | Socket Firewall Free | Yes (confirmed-malicious); warn-only (unconfirmed) |
| All third-party Actions SHA-pinned | pinact CI check | Yes |
| PR template complete (Change Management §5) | Manual + reviewer | Yes |
| CODEOWNER review approved — author ≠ approver | GitHub + CODEOWNERS | Yes |
| No secrets / credentials in the diff | Reviewer | Yes |
| Docs / runbook updated where behavior changed | Reviewer | Yes |
Gate 2 — Production-deploy gate (must pass before deploy to main)
The image that passed Gate 1 and was tested in nonprod may be promoted to production only when:
| Check | Mechanism | Blocking |
|---|---|---|
| Same image that passed Gate 1 and nonprod testing | ECR digest match | Yes |
| GitHub Environment "production" required-reviewer gate | GitHub Environments | Yes |
| Two-reviewer (four-eyes) approval where staffing allows | Separation of Duties §4 | Yes when staffed |
| Deploy job is separate from validation | GitHub Actions job split | Yes |
| Short-lived OIDC credentials only | AWS OIDC trust | Yes |
| Least-privilege deploy role | IAM role | Yes |
| Rolling deploy + circuit breaker + auto-rollback | ECS Fargate | Yes |
3. Exception process
Exceptions are rare and individually approved:
- The PR description states the exception (which check, why it cannot be satisfied, mitigations).
- CTO & CSO approves the exception inline on the PR before merge.
- The exception is recorded against the Evidence Register.
- A follow-up PR closing the exception is filed within 30 days, or the exception is re-approved with a new target.
A scanner false-positive is documented and suppressed at the tool level (e.g. .semgrepignore with a comment + linked issue), not as a recurring exception.
4. Emergency deploys
Per Change Management §8, Emergency PRs may bypass non-blocking checks under an expedited review — but the security blocking checks in Gate 1 are NOT bypassable even in emergencies; they exist to prevent the emergency from becoming a worse incident. Retroactive CODEOWNER review within 1 business day still applies.
5. Evidence
Every CI run + deploy log linked to a merged PR is the gate evidence. Retained ≥ 12 months per the Evidence Collection & Retention Policy. Type II will sample.
6. Document change history
| Version | Date | Author | Description of change | Approved by |
|---|---|---|---|---|
| 1.0 | 2026-05-26 | Ron Benisty (CTO & CSO) | Initial version — codifies the Release Gate Criteria. | Ron Benisty (CTO & CSO) |