From 91a834010be62f257addf2e5ddb07a5f0db5865f Mon Sep 17 00:00:00 2001 From: Maurice Date: Tue, 20 Oct 2026 08:22:40 +0200 Subject: [PATCH] ci(sonar): leave the React root and the mascot videos out of the analysis Every scan spent 300 of its 450-830 seconds in the JS security sensor's React render simulation, which starts at client/src/main.tsx and ran into its fixed time limit each time. main.tsx holds the stylesheets and the mount call; what it renders is analysed through its own files. The .mp4 clips under client/src were read as text and only produced encoding warnings. --- sonar-project.properties | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/sonar-project.properties b/sonar-project.properties index 25c218307..a7b8a9d27 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -19,7 +19,9 @@ sonar.test.inclusions=\ shared/src/**/*.spec.ts,\ plugin-sdk/test/**/*.test.ts -# Keep generated output and test files out of source analysis +# Keep generated output, test files and media out of source analysis (the +# mascot clips under client/src are video; read as text they only fill the +# log with encoding warnings) sonar.exclusions=\ **/node_modules/**,\ **/dist/**,\ @@ -29,7 +31,16 @@ sonar.exclusions=\ **/*.test.ts,\ **/*.test.tsx,\ **/*.spec.ts,\ - **/*.d.ts + **/*.d.ts,\ + **/*.mp4,\ + client/src/main.tsx + +# client/src/main.tsx above is the React root (the stylesheets and the mount +# call around ). From it the JS security sensor simulates rendering +# the whole app, and that simulation ran into its fixed 300 s limit on every +# scan, which was most of the scan's time. The file holds no logic of its +# own; everything it renders is analysed through its own files. The vitest +# config leaves it out of coverage for the same reason. # Coverage — lcov paths relative to repo root, one per package # (each package's vitest config emits lcov to /coverage/).