Courts IT blocks merges on the case-management repo unless AI-assisted code scanning passes. Which CI/CD security practice is this?

AI-assisted code scanning that gates merges on the courts case-management repository is a CI/CD security practice that blocks vulnerable or policy-violating code before it becomes part of the protected branch. The gate works because merge authority is conditioned on automated review signals—static analysis, AI-assisted finding prioritization, and policy checks—so developers cannot casually bypass security quality on systems that handle sensitive court filings and case data. Requiring a passing scan before merge reduces defect leakage into municipal justice workloads where confidentiality, integrity, and availability failures have outsized civic impact. AI-assisted dependency scanning that gates merges on the courts case-management repo fails because the scenario describes blocking merges based on findings in first-party code, not third-party components; dependency scanning examines libraries and transitive packages rather than AI-assisted analysis of source code. AI-assisted secret scanning that gates merges on the courts case-management repo fails because the scenario describes blocking merges based on code vulnerabilities, not exposed credentials; secret scanning detects hardcoded passwords, API keys, and tokens rather than AI-assisted analysis of code flaws. AI-assisted container scanning that gates merges on the courts case-management repo fails because the scenario describes blocking merges based on first-party code findings, not container risks; container scanning examines base images, OS packages, and misconfigurations in container definitions rather than AI-assisted analysis of source code. Exam caveat: a green scan is necessary but not sufficient; AI findings can miss business-logic flaws, and noisy scanners tempt teams to waive everything—waiver governance matters. Operational check: make the courts repo’s merge checks mandatory and non-bypassable for privileged roles, track waived findings with expiry owners, and verify that secrets scanning and dependency checks are included alongside AI-assisted SAST in the same gate set.