Composer’s audit as the only gate that has ever failed

Four merge gates on the pipeline, and after a year one of them has ever blocked anything.

the gates, and their record over 14 months:

  tests                    blocked 188 merges
  static analysis          blocked 41
  migration safety check   blocked 11
  composer audit           blocked 3

and the interesting number is not the count. it is that
the audit is the only one that blocked a merge nobody
had any reason to expect would be blocked.

the other three fail because of what you just wrote.
the audit fails because of what somebody else published
last night.

A gate that fails on your own change is feedback and a gate that fails on somebody else’s is an interruption, which is why the audit is the one people want to disable. All three firings were a patch bump and one was a package with no fix, which needed an ignore entry with a review date rather than a lowered threshold.