It all started when the Senior Architect dropped by the daily standup. The team lead had the backlog up on the big screen and there was a story about code quality marked "behind schedule".
"What does that story mean?" the architect asked.
"We have the static analysis tool implemented in the CI/CD pipeline, but enforcement is turned off because the findings are going to take a long time to fix." They weren't lying... Cyclomatic complexity scores of 154 (when the target is 15) are scary, and there were at least 10 different modules with methods scoring that high. Test coverage was weak... maybe 40% when the goal was 80. Duplicated code was about 4-5x the allowed 3%.
The architect frowned. "We need to start enforcing ASAP. Things are never going to get better until we develop some discipline about what we push up."
So... they turned on enforcement. No PR could be merged unless it passed the scan.
