mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
jubnl
f5bfc321d7
Instance-specific findings (S2245 singles, S4790, S5332, S2819, S7767, S4158 sessionManager, S8786, S6825) are resolved server-side as false positive / accepted / reviewed-safe instead, so future violations of the same rule in the same file still surface. Narrow the i18n secrets scope to the locale directories so top-level code files stay fully scanned, and drop the comment claims the code contradicts.
120 lines
5.2 KiB
Properties
120 lines
5.2 KiB
Properties
sonar.projectKey=liketrek_TREK
|
|
sonar.organization=liketrek
|
|
sonar.projectName=TREK
|
|
sonar.sourceEncoding=UTF-8
|
|
|
|
# Sources — one entry per workspace package (plugin-sdk is standalone but lives in-repo)
|
|
sonar.sources=client/src,server/src,shared/src,plugin-sdk/src
|
|
|
|
# Tests — dedicated test dirs per package, plus co-located client tests in src
|
|
# and co-located shared schema/sanitize/i18n specs in shared/src
|
|
sonar.tests=server/tests,client/tests,client/e2e,client/src,shared/src,plugin-sdk/test
|
|
sonar.test.inclusions=\
|
|
server/tests/**/*.test.ts,\
|
|
client/tests/**/*.test.ts,\
|
|
client/tests/**/*.test.tsx,\
|
|
client/e2e/**/*.spec.ts,\
|
|
client/src/**/*.test.ts,\
|
|
client/src/**/*.test.tsx,\
|
|
shared/src/**/*.spec.ts,\
|
|
plugin-sdk/test/**/*.test.ts
|
|
|
|
# Keep generated output and test files out of source analysis
|
|
sonar.exclusions=\
|
|
**/node_modules/**,\
|
|
**/dist/**,\
|
|
**/build/**,\
|
|
**/coverage/**,\
|
|
client/dev-dist/**,\
|
|
**/*.test.ts,\
|
|
**/*.test.tsx,\
|
|
**/*.spec.ts,\
|
|
**/*.d.ts
|
|
|
|
# Coverage — lcov paths relative to repo root, one per package
|
|
# (each package's vitest config emits lcov to <pkg>/coverage/).
|
|
sonar.javascript.lcov.reportPaths=\
|
|
server/coverage/lcov.info,\
|
|
client/coverage/lcov.info,\
|
|
shared/coverage/lcov.info,\
|
|
plugin-sdk/coverage/lcov.info
|
|
|
|
# Infrastructure/bootstrap files plus generated/data files the vitest configs
|
|
# exclude from instrumentation (a file absent from lcov would otherwise count
|
|
# as 0% covered here — keep these in sync with each package's vitest.config.ts)
|
|
sonar.coverage.exclusions=\
|
|
server/src/index.ts,\
|
|
server/src/config.ts,\
|
|
server/src/db/database.ts,\
|
|
server/src/db/migrations.ts,\
|
|
server/src/db/seeds.ts,\
|
|
server/src/demo/**,\
|
|
server/src/nest/plugins/runtime/plugin-host-entry.ts,\
|
|
server/assets/**,\
|
|
client/src/main.tsx,\
|
|
client/src/types.ts,\
|
|
shared/src/plugin-permissions.ts,\
|
|
shared/src/i18n/*/**,\
|
|
plugin-sdk/src/generated/**,\
|
|
plugin-sdk/src/lucide-icon-names.ts
|
|
|
|
# Locale files are large near-identical literal objects — keep them out of duplication metrics
|
|
sonar.cpd.exclusions=shared/src/i18n/**
|
|
|
|
|
|
# Only categorical, path-wide suppressions live here — cases where the rule can
|
|
# never meaningfully apply to anything in the path. Instance-specific findings
|
|
# (a handful of flagged lines in one file) are resolved as false positive /
|
|
# accepted / reviewed-safe on SonarCloud instead, so a future violation of the
|
|
# same rule in the same file still surfaces.
|
|
sonar.issue.ignore.multicriteria=i18nsec1,i18nsec2,i18nsec3,rand1,rand2,path1,empty2
|
|
|
|
|
|
# Locale files are UI copy — strings like "Password", "API key", "token" are
|
|
# labels, not credentials, and the secret detectors false-positive on them
|
|
# constantly. Ignore the secrets analyzer and the hard-coded-credential rules on
|
|
# the locale directories only (shared/src/i18n/*/** — the top-level code files
|
|
# such as languages.ts stay fully scanned).
|
|
|
|
sonar.issue.ignore.multicriteria.i18nsec1.ruleKey=secrets:*
|
|
sonar.issue.ignore.multicriteria.i18nsec1.resourceKey=shared/src/i18n/*/**
|
|
sonar.issue.ignore.multicriteria.i18nsec2.ruleKey=typescript:S2068
|
|
sonar.issue.ignore.multicriteria.i18nsec2.resourceKey=shared/src/i18n/*/**
|
|
sonar.issue.ignore.multicriteria.i18nsec3.ruleKey=typescript:S6418
|
|
sonar.issue.ignore.multicriteria.i18nsec3.resourceKey=shared/src/i18n/*/**
|
|
|
|
|
|
# S2245 (Math.random in a security context) — Studio + studioStore only: minting
|
|
# element and spread ids with Math.random is pervasive by design there (uid()
|
|
# helpers across the whole component tree), so per-instance marks would recur on
|
|
# every refactor. The ids live inside the photo-book document, stored and
|
|
# fetched as one blob scoped by journey id — the server never indexes, looks up
|
|
# or authorizes on an element or spread id. Worst case of a collision is
|
|
# documented in studioStore itself: two elements would share a selection.
|
|
|
|
sonar.issue.ignore.multicriteria.rand1.ruleKey=typescript:S2245
|
|
sonar.issue.ignore.multicriteria.rand1.resourceKey=client/src/components/Studio/**
|
|
sonar.issue.ignore.multicriteria.rand2.ruleKey=typescript:S2245
|
|
sonar.issue.ignore.multicriteria.rand2.resourceKey=client/src/store/studioStore.ts
|
|
|
|
|
|
# S4036 (OS command via PATH) — the plugin SDK is a CLI a plugin author runs on
|
|
# their own machine, and reaching git/gh/npm through the developer's own PATH is
|
|
# the point of it. Every child-process invocation passes an argv array with no
|
|
# shell, so nothing is shell-parsed. The one server-side site was NOT
|
|
# suppressed: it resolves its binary to an absolute path before spawning
|
|
# (see server/src/nest/booking-import/kitinerary-extractor.service.ts).
|
|
|
|
sonar.issue.ignore.multicriteria.path1.ruleKey=typescript:S4036
|
|
sonar.issue.ignore.multicriteria.path1.resourceKey=plugin-sdk/src/cli/**
|
|
|
|
|
|
# S4158 (empty collection accessed) — client/src/managed is a build-time seam:
|
|
# the arrays are empty in this repo and in every build of it, and an operator
|
|
# shipping extra screens replaces the file. Its header comment makes reading
|
|
# them unconditionally a rule, so the public build takes the same code path as
|
|
# a managed one.
|
|
|
|
sonar.issue.ignore.multicriteria.empty2.ruleKey=typescript:S4158
|
|
sonar.issue.ignore.multicriteria.empty2.resourceKey=client/src/managed/**
|