mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
8997640ac9
Since the ORM migration the scan of every push to dev stops with "the Node.js process running out of memory (heap size limit 4288 MB)" and fails the job, while PR scans, which only analyse changed files, stay under it. The hosted runner has 16 GB.
134 lines
6.0 KiB
Properties
134 lines
6.0 KiB
Properties
sonar.projectKey=liketrek_TREK
|
|
sonar.organization=liketrek
|
|
sonar.projectName=TREK
|
|
sonar.sourceEncoding=UTF-8
|
|
|
|
# Sources — one entry per workspace package (plugin-sdk is standalone but lives in-repo)
|
|
sonar.sources=client/src,server/src,shared/src,plugin-sdk/src
|
|
|
|
# Tests — dedicated test dirs per package, plus co-located client tests in src
|
|
# and co-located shared schema/sanitize/i18n specs in shared/src
|
|
sonar.tests=server/tests,client/tests,client/e2e,client/src,shared/src,plugin-sdk/test
|
|
sonar.test.inclusions=\
|
|
server/tests/**/*.test.ts,\
|
|
client/tests/**/*.test.ts,\
|
|
client/tests/**/*.test.tsx,\
|
|
client/e2e/**/*.spec.ts,\
|
|
client/src/**/*.test.ts,\
|
|
client/src/**/*.test.tsx,\
|
|
shared/src/**/*.spec.ts,\
|
|
plugin-sdk/test/**/*.test.ts
|
|
|
|
# Keep generated output and test files out of source analysis
|
|
sonar.exclusions=\
|
|
**/node_modules/**,\
|
|
**/dist/**,\
|
|
**/build/**,\
|
|
**/coverage/**,\
|
|
client/dev-dist/**,\
|
|
**/*.test.ts,\
|
|
**/*.test.tsx,\
|
|
**/*.spec.ts,\
|
|
**/*.d.ts
|
|
|
|
# Coverage — lcov paths relative to repo root, one per package
|
|
# (each package's vitest config emits lcov to <pkg>/coverage/).
|
|
sonar.javascript.lcov.reportPaths=\
|
|
server/coverage/lcov.info,\
|
|
client/coverage/lcov.info,\
|
|
shared/coverage/lcov.info,\
|
|
plugin-sdk/coverage/lcov.info
|
|
|
|
# Infrastructure/bootstrap files plus generated/data files the vitest configs
|
|
# exclude from instrumentation (a file absent from lcov would otherwise count
|
|
# as 0% covered here — keep these in sync with each package's vitest.config.ts)
|
|
sonar.coverage.exclusions=\
|
|
server/src/index.ts,\
|
|
server/src/config.ts,\
|
|
server/src/db/database.ts,\
|
|
server/src/demo/**,\
|
|
server/src/nest/plugins/runtime/plugin-host-entry.ts,\
|
|
server/assets/**,\
|
|
client/src/main.tsx,\
|
|
client/src/types.ts,\
|
|
shared/src/plugin-permissions.ts,\
|
|
shared/src/i18n/*/**,\
|
|
plugin-sdk/src/generated/**,\
|
|
plugin-sdk/src/lucide-icon-names.ts
|
|
|
|
# Locale files are large near-identical literal objects — keep them out of duplication metrics
|
|
sonar.cpd.exclusions=shared/src/i18n/**
|
|
|
|
# The full analysis of a push to dev outgrows the JS/TS analyser's default heap
|
|
# of about 4 GB since the ORM migration and stops with "Analysis of JS/TS files
|
|
# failed". PR scans stay below it because they only look at the changed files.
|
|
# The hosted runner has 16 GB.
|
|
sonar.javascript.node.maxspace=8192
|
|
|
|
|
|
# Only categorical, path-wide suppressions live here — cases where the rule can
|
|
# never meaningfully apply to anything in the path. Instance-specific findings
|
|
# (a handful of flagged lines in one file) are resolved as false positive /
|
|
# accepted / reviewed-safe on SonarCloud instead, so a future violation of the
|
|
# same rule in the same file still surfaces.
|
|
sonar.issue.ignore.multicriteria=i18nsec1,i18nsec2,i18nsec3,rand1,rand2,path1,empty2,legacy1
|
|
|
|
|
|
# Locale files are UI copy — strings like "Password", "API key", "token" are
|
|
# labels, not credentials, and the secret detectors false-positive on them
|
|
# constantly. Ignore the secrets analyzer and the hard-coded-credential rules on
|
|
# the locale directories only (shared/src/i18n/*/** — the top-level code files
|
|
# such as languages.ts stay fully scanned).
|
|
|
|
sonar.issue.ignore.multicriteria.i18nsec1.ruleKey=secrets:*
|
|
sonar.issue.ignore.multicriteria.i18nsec1.resourceKey=shared/src/i18n/*/**
|
|
sonar.issue.ignore.multicriteria.i18nsec2.ruleKey=typescript:S2068
|
|
sonar.issue.ignore.multicriteria.i18nsec2.resourceKey=shared/src/i18n/*/**
|
|
sonar.issue.ignore.multicriteria.i18nsec3.ruleKey=typescript:S6418
|
|
sonar.issue.ignore.multicriteria.i18nsec3.resourceKey=shared/src/i18n/*/**
|
|
|
|
|
|
# S2245 (Math.random in a security context) — Studio + studioStore only: minting
|
|
# element and spread ids with Math.random is pervasive by design there (uid()
|
|
# helpers across the whole component tree), so per-instance marks would recur on
|
|
# every refactor. The ids live inside the photo-book document, stored and
|
|
# fetched as one blob scoped by journey id — the server never indexes, looks up
|
|
# or authorizes on an element or spread id. Worst case of a collision is
|
|
# documented in studioStore itself: two elements would share a selection.
|
|
|
|
sonar.issue.ignore.multicriteria.rand1.ruleKey=typescript:S2245
|
|
sonar.issue.ignore.multicriteria.rand1.resourceKey=client/src/components/Studio/**
|
|
sonar.issue.ignore.multicriteria.rand2.ruleKey=typescript:S2245
|
|
sonar.issue.ignore.multicriteria.rand2.resourceKey=client/src/store/studioStore.ts
|
|
|
|
|
|
# S4036 (OS command via PATH) — the plugin SDK is a CLI a plugin author runs on
|
|
# their own machine, and reaching git/gh/npm through the developer's own PATH is
|
|
# the point of it. Every child-process invocation passes an argv array with no
|
|
# shell, so nothing is shell-parsed. The one server-side site was NOT
|
|
# suppressed: it resolves its binary to an absolute path before spawning
|
|
# (see server/src/nest/booking-import/kitinerary-extractor.service.ts).
|
|
|
|
sonar.issue.ignore.multicriteria.path1.ruleKey=typescript:S4036
|
|
sonar.issue.ignore.multicriteria.path1.resourceKey=plugin-sdk/src/cli/**
|
|
|
|
|
|
# S4158 (empty collection accessed) — client/src/managed is a build-time seam:
|
|
# the arrays are empty in this repo and in every build of it, and an operator
|
|
# shipping extra screens replaces the file. Its header comment makes reading
|
|
# them unconditionally a rule, so the public build takes the same code path as
|
|
# a managed one.
|
|
|
|
sonar.issue.ignore.multicriteria.empty2.ruleKey=typescript:S4158
|
|
sonar.issue.ignore.multicriteria.empty2.resourceKey=client/src/managed/**
|
|
|
|
|
|
# S2187 (test file without test cases) — the legacy-upgrade files each pin one
|
|
# fixture (an install the retired positional runner left at schema_version N)
|
|
# and hand it to describeLegacyUpgrade() in tests/helpers/legacy-upgrade-suite.ts,
|
|
# which registers the five cases every fixture must pass. The rule only sees the
|
|
# call, not the it() blocks behind it, so it fires on every such file by design.
|
|
|
|
sonar.issue.ignore.multicriteria.legacy1.ruleKey=typescript:S2187
|
|
sonar.issue.ignore.multicriteria.legacy1.resourceKey=server/tests/integration/legacy-upgrade-v*.test.ts
|