During deployment, code scanning shows Security rating C and Code Coverage 10%. Which action should be taken first?

During deployment, code scanning shows Security rating C and Code Coverage 10%. Which action should be taken first?

• A. Override this build step and proceed with deployment.
• B. Request the developer to resolve Code Coverage issues.
• C. Request the developer to resolve Security Rating issues.
• D. Start a new Deployment Pipeline with manual override.

Answer: (B)

Quality gates in deployment pipelines rely on measurable thresholds like test coverage to protect release quality. A code coverage of 10% is far below typical minimums, meaning a large portion of the code isn’t tested and unknown defects could slip into production. Prioritizing fixes to raise coverage ensures the codebase has adequate tests to catch regressions and verify behavior before release. Security findings flagged as C indicate potential risks, and they must be addressed, but they don’t automatically block a pipeline if coverage gates are the active barrier. The immediate, enforceable action to enable progression is to have the developer improve the test suite so coverage meets the required threshold. Once coverage is raised, security issues can be triaged and remediated in subsequent steps. Overriding the build step or starting a new pipeline with a manual override would bypass important quality gates and undermine confidence in the release. Requesting fixes to security issues without addressing the failing coverage gate would leave the deployment blocked by the gate you actually need to satisfy first.

Quality gates in deployment pipelines rely on measurable thresholds like test coverage to protect release quality. A code coverage of 10% is far below typical minimums, meaning a large portion of the code isn’t tested and unknown defects could slip into production. Prioritizing fixes to raise coverage ensures the codebase has adequate tests to catch regressions and verify behavior before release.

Security findings flagged as C indicate potential risks, and they must be addressed, but they don’t automatically block a pipeline if coverage gates are the active barrier. The immediate, enforceable action to enable progression is to have the developer improve the test suite so coverage meets the required threshold. Once coverage is raised, security issues can be triaged and remediated in subsequent steps.

Overriding the build step or starting a new pipeline with a manual override would bypass important quality gates and undermine confidence in the release. Requesting fixes to security issues without addressing the failing coverage gate would leave the deployment blocked by the gate you actually need to satisfy first.