A merge gate on severity

Security review used to report and never block. Now each repository decides what is serious enough to stop a merge.

• One setting, both checks. In Connections, GitHub, a repository's settings have a Merge gate: a Block merging switch and a severity, Critical, High, Medium or Low. It starts on, at High.
• ZeusQA Security. No findings: the check passes. A finding at the severity or above: the check fails and names how many block. Findings only below it: the check is neutral and merging goes ahead. Info never blocks.
• Unreviewed means blocked. A commit the review could not cover, because it was over a limit, the review failed twice or the review could not be queued, does not pass while the gate is on. Its check asks for action and says why; re-run it once the limit resets and the result follows the severity. The one exception is ZeusQA's shared 40 a day: that capacity is not your workspace's, so a commit past it stays neutral.
• ZeusQA. A failing run fails the check, as before, unless all it found is below the severity. A failed check, an acceptance criterion not met, or a failure with no findings always blocks.
• Every push. The gate is read when each commit's check completes, so the next push is judged by the setting you saved.
• Strictest wins. If more than one connected row covers the same repository, the one that blocks the most decides.
• Off is off. Turn Block merging off and both checks report a failing run, findings and an unreviewed commit as neutral. The severity you picked is kept for when you turn it back on.

GitHub decides what a check can stop. Add ZeusQA and ZeusQA Security as required status checks in a branch ruleset and a failing check blocks the merge. ZeusQA does not change your branch protection and asks for no new permission.

Repositories that blocked on a failing run before stay on, now at High: a run that fails only on medium, low or info findings reports as neutral. Pick Low to block on those too.