mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-24 07:53:09 +00:00
Maurice
815a523d1c
- The design prompt keeps the print rules and adds energy: calm keeps today's rules, lively and loud layer photos, tilt, set oversize display type and block colour. Type sizes come as numbers relative to the page, and the model answers eight silent questions and previews the cover twice before it proposes. - The type scale reaches 2.5 and a display tier sets a cover title up to 200 pt; existing books keep their sizes. - An overlap is severe only where more than half of a photo or a text is covered by accident; a title over a photo, a framed inset or a turned photo is layering. - The assistant may use every icon of the icon tab, checked by name, and every enum of the book tools says what its values mean.
151 lines
7.0 KiB
Properties
151 lines
7.0 KiB
Properties
sonar.projectKey=liketrek_TREK
|
|
sonar.organization=liketrek
|
|
sonar.projectName=TREK
|
|
sonar.sourceEncoding=UTF-8
|
|
|
|
# Sources — one entry per workspace package (plugin-sdk is standalone but lives in-repo)
|
|
sonar.sources=client/src,server/src,shared/src,plugin-sdk/src
|
|
|
|
# Tests — dedicated test dirs per package, plus co-located client tests in src
|
|
# and co-located shared schema/sanitize/i18n specs in shared/src
|
|
sonar.tests=server/tests,client/tests,client/e2e,client/src,shared/src,plugin-sdk/test
|
|
sonar.test.inclusions=\
|
|
server/tests/**/*.test.ts,\
|
|
client/tests/**/*.test.ts,\
|
|
client/tests/**/*.test.tsx,\
|
|
client/e2e/**/*.spec.ts,\
|
|
client/src/**/*.test.ts,\
|
|
client/src/**/*.test.tsx,\
|
|
shared/src/**/*.spec.ts,\
|
|
plugin-sdk/test/**/*.test.ts
|
|
|
|
# Keep generated output, test files and media out of source analysis (the
|
|
# mascot clips under client/src are video; read as text they only fill the
|
|
# log with encoding warnings)
|
|
sonar.exclusions=\
|
|
**/node_modules/**,\
|
|
**/dist/**,\
|
|
**/build/**,\
|
|
**/coverage/**,\
|
|
client/dev-dist/**,\
|
|
**/*.test.ts,\
|
|
**/*.test.tsx,\
|
|
**/*.spec.ts,\
|
|
**/*.d.ts,\
|
|
**/*.mp4,\
|
|
client/src/main.tsx
|
|
|
|
# client/src/main.tsx above is the React root (the stylesheets and the mount
|
|
# call around <App/>). From it the JS security sensor simulates rendering
|
|
# the whole app, and that simulation ran into its fixed 300 s limit on every
|
|
# scan, which was most of the scan's time. The file holds no logic of its
|
|
# own; everything it renders is analysed through its own files. The vitest
|
|
# config leaves it out of coverage for the same reason.
|
|
|
|
# Coverage — lcov paths relative to repo root, one per package
|
|
# (each package's vitest config emits lcov to <pkg>/coverage/).
|
|
sonar.javascript.lcov.reportPaths=\
|
|
server/coverage/lcov.info,\
|
|
client/coverage/lcov.info,\
|
|
shared/coverage/lcov.info,\
|
|
plugin-sdk/coverage/lcov.info
|
|
|
|
# Infrastructure/bootstrap files plus generated/data files the vitest configs
|
|
# exclude from instrumentation (a file absent from lcov would otherwise count
|
|
# as 0% covered here — keep these in sync with each package's vitest.config.ts)
|
|
sonar.coverage.exclusions=\
|
|
server/src/index.ts,\
|
|
server/src/config.ts,\
|
|
server/src/db/database.ts,\
|
|
server/src/demo/**,\
|
|
server/src/nest/plugins/runtime/plugin-host-entry.ts,\
|
|
server/assets/**,\
|
|
client/src/main.tsx,\
|
|
client/src/types.ts,\
|
|
shared/src/plugin-permissions.ts,\
|
|
shared/src/i18n/*/**,\
|
|
plugin-sdk/src/generated/**,\
|
|
plugin-sdk/src/lucide-icon-names.ts
|
|
|
|
# Locale files are large near-identical literal objects — keep them out of duplication metrics
|
|
# server/src/db/kysely/ is generated from the migrated schema by
|
|
# server/scripts/generate-db-types.ts (one interface per table, CI checks it with
|
|
# check:db-types), so a column list two tables share is not copied code.
|
|
# shared/src/book/book-icon-names-*.data.ts is the lucide name list the book
|
|
# engine takes, generated by shared/scripts/gen-book-icon-names.mjs: three
|
|
# files of one quoted name per line, data rather than code.
|
|
sonar.cpd.exclusions=shared/src/i18n/**,server/src/db/kysely/**,shared/src/book/book-icon-names-*.data.ts
|
|
|
|
# The full analysis of a push to dev outgrows the JS/TS analyser's default heap
|
|
# of about 4 GB since the ORM migration and stops with "Analysis of JS/TS files
|
|
# failed". PR scans stay below it because they only look at the changed files.
|
|
# The hosted runner has 16 GB.
|
|
sonar.javascript.node.maxspace=8192
|
|
|
|
|
|
# Only categorical, path-wide suppressions live here — cases where the rule can
|
|
# never meaningfully apply to anything in the path. Instance-specific findings
|
|
# (a handful of flagged lines in one file) are resolved as false positive /
|
|
# accepted / reviewed-safe on SonarCloud instead, so a future violation of the
|
|
# same rule in the same file still surfaces.
|
|
sonar.issue.ignore.multicriteria=i18nsec1,i18nsec2,i18nsec3,rand1,rand2,path1,empty2,legacy1
|
|
|
|
|
|
# Locale files are UI copy — strings like "Password", "API key", "token" are
|
|
# labels, not credentials, and the secret detectors false-positive on them
|
|
# constantly. Ignore the secrets analyzer and the hard-coded-credential rules on
|
|
# the locale directories only (shared/src/i18n/*/** — the top-level code files
|
|
# such as languages.ts stay fully scanned).
|
|
|
|
sonar.issue.ignore.multicriteria.i18nsec1.ruleKey=secrets:*
|
|
sonar.issue.ignore.multicriteria.i18nsec1.resourceKey=shared/src/i18n/*/**
|
|
sonar.issue.ignore.multicriteria.i18nsec2.ruleKey=typescript:S2068
|
|
sonar.issue.ignore.multicriteria.i18nsec2.resourceKey=shared/src/i18n/*/**
|
|
sonar.issue.ignore.multicriteria.i18nsec3.ruleKey=typescript:S6418
|
|
sonar.issue.ignore.multicriteria.i18nsec3.resourceKey=shared/src/i18n/*/**
|
|
|
|
|
|
# S2245 (Math.random in a security context) — Studio + studioStore only: minting
|
|
# element and spread ids with Math.random is pervasive by design there (uid()
|
|
# helpers across the whole component tree), so per-instance marks would recur on
|
|
# every refactor. The ids live inside the photo-book document, stored and
|
|
# fetched as one blob scoped by journey id — the server never indexes, looks up
|
|
# or authorizes on an element or spread id. Worst case of a collision is
|
|
# documented in studioStore itself: two elements would share a selection.
|
|
|
|
sonar.issue.ignore.multicriteria.rand1.ruleKey=typescript:S2245
|
|
sonar.issue.ignore.multicriteria.rand1.resourceKey=client/src/components/Studio/**
|
|
sonar.issue.ignore.multicriteria.rand2.ruleKey=typescript:S2245
|
|
sonar.issue.ignore.multicriteria.rand2.resourceKey=client/src/store/studioStore.ts
|
|
|
|
|
|
# S4036 (OS command via PATH) — the plugin SDK is a CLI a plugin author runs on
|
|
# their own machine, and reaching git/gh/npm through the developer's own PATH is
|
|
# the point of it. Every child-process invocation passes an argv array with no
|
|
# shell, so nothing is shell-parsed. The one server-side site was NOT
|
|
# suppressed: it resolves its binary to an absolute path before spawning
|
|
# (see server/src/nest/booking-import/kitinerary-extractor.service.ts).
|
|
|
|
sonar.issue.ignore.multicriteria.path1.ruleKey=typescript:S4036
|
|
sonar.issue.ignore.multicriteria.path1.resourceKey=plugin-sdk/src/cli/**
|
|
|
|
|
|
# S4158 (empty collection accessed) — client/src/managed is a build-time seam:
|
|
# the arrays are empty in this repo and in every build of it, and an operator
|
|
# shipping extra screens replaces the file. Its header comment makes reading
|
|
# them unconditionally a rule, so the public build takes the same code path as
|
|
# a managed one.
|
|
|
|
sonar.issue.ignore.multicriteria.empty2.ruleKey=typescript:S4158
|
|
sonar.issue.ignore.multicriteria.empty2.resourceKey=client/src/managed/**
|
|
|
|
|
|
# S2187 (test file without test cases) — the legacy-upgrade files each pin one
|
|
# fixture (an install the retired positional runner left at schema_version N)
|
|
# and hand it to describeLegacyUpgrade() in tests/helpers/legacy-upgrade-suite.ts,
|
|
# which registers the five cases every fixture must pass. The rule only sees the
|
|
# call, not the it() blocks behind it, so it fires on every such file by design.
|
|
|
|
sonar.issue.ignore.multicriteria.legacy1.ruleKey=typescript:S2187
|
|
sonar.issue.ignore.multicriteria.legacy1.resourceKey=server/tests/integration/legacy-upgrade-v*.test.ts
|