-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathsonar-project.properties
More file actions
86 lines (76 loc) · 5.2 KB
/
Copy pathsonar-project.properties
File metadata and controls
86 lines (76 loc) · 5.2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
sonar.projectKey=gamgui
sonar.projectName=GamGUI
sonar.sources=gamgui
sonar.tests=tests
sonar.python.version=3.9,3.12
# Vendored GAM7 binary/grammar + generated catalog data are not our source to analyze.
sonar.exclusions=gamgui/resources/**
sonar.sourceEncoding=UTF-8
# Test coverage (pytest --cov, repo-root-relative paths — see [tool.coverage.run] in pyproject.toml).
sonar.python.coverage.reportPaths=coverage.xml
# Exclude from the coverage *metric* only (still analyzed for issues): the pywebview entry point and
# the Jinja templates, whose inline JS/HTML is exercised via the live preview + manual QA, not pytest.
sonar.coverage.exclusions=gamgui/app.py,gamgui/__main__.py,gamgui/web/templates/**
# ---------------------------------------------------------------------------
# Accepted findings (deliberate "won't fix" — scoped per file with rationale).
# Everything else flagged by Sonar has been fixed; these are the residual items
# where the rule conflicts with an intentional design decision in this codebase.
# ---------------------------------------------------------------------------
sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5,e6,e7,e8,e9,e10,e11,e12,e13,e14,e15
# S3776 cognitive complexity — inherently branchy code we keep in one place on
# purpose: the GAM grammar/slot parsers, the connector write path, report
# aggregation, and the catalog/calendar route dispatchers. Splitting them would
# scatter logic that is clearer read top-to-bottom; covered by tests instead.
sonar.issue.ignore.multicriteria.e1.ruleKey=python:S3776
sonar.issue.ignore.multicriteria.e1.resourceKey=gamgui/core/catalog/parser.py
sonar.issue.ignore.multicriteria.e2.ruleKey=python:S3776
sonar.issue.ignore.multicriteria.e2.resourceKey=gamgui/core/catalog/readbuilder.py
sonar.issue.ignore.multicriteria.e3.ruleKey=python:S3776
sonar.issue.ignore.multicriteria.e3.resourceKey=gamgui/core/connectors/gam_connector.py
sonar.issue.ignore.multicriteria.e4.ruleKey=python:S3776
sonar.issue.ignore.multicriteria.e4.resourceKey=gamgui/core/reports.py
sonar.issue.ignore.multicriteria.e5.ruleKey=python:S3776
sonar.issue.ignore.multicriteria.e5.resourceKey=gamgui/web/routes/builder.py
sonar.issue.ignore.multicriteria.e6.ruleKey=python:S3776
sonar.issue.ignore.multicriteria.e6.resourceKey=gamgui/web/routes/calendars.py
# S7483 asyncio timeout — runner.py spawns gam via create_subprocess_exec and
# already enforces a timeout by wrapping communicate() in asyncio.wait_for(...)
# with kill-on-timeout. The rule wants a timeout= arg on the call itself; the
# wait_for envelope is our timeout mechanism, so this is a false positive here.
sonar.issue.ignore.multicriteria.e7.ruleKey=python:S7483
sonar.issue.ignore.multicriteria.e7.resourceKey=gamgui/core/gam/runner.py
# S7632 — flags our intentional `# noqa: BLE001` ruff suppressions on the few
# deliberately-broad `except Exception` blocks that isolate per-step failures
# (onboarding/sequence runs) and surface remediation to the user. ruff's noqa is
# our suppression channel; keep it.
sonar.issue.ignore.multicriteria.e8.ruleKey=python:S7632
sonar.issue.ignore.multicriteria.e8.resourceKey=gamgui/**/*.py
# S2004 nested functions — the result-table module (filter/paginate/count) is a
# small self-contained closure tree; flattening it would expose internals as
# globals for no benefit. Verified working in the live preview.
sonar.issue.ignore.multicriteria.e9.ruleKey=javascript:S2004
sonar.issue.ignore.multicriteria.e9.resourceKey=gamgui/web/templates/builder.html
# S2486 — two best-effort/defensive catches that intentionally swallow and fall
# back: the execCommand("copy") legacy path and the JSON.parse of drag payloads.
# Both return a safe default; there is nothing actionable to do with the error.
sonar.issue.ignore.multicriteria.e10.ruleKey=javascript:S2486
sonar.issue.ignore.multicriteria.e10.resourceKey=gamgui/web/templates/base.html
sonar.issue.ignore.multicriteria.e11.ruleKey=javascript:S2486
sonar.issue.ignore.multicriteria.e11.resourceKey=gamgui/web/templates/groups.html
# S5725 Subresource Integrity — Tailwind's JIT CDN and Google Fonts are served
# versionless/rolling, so there is no stable hash to pin. (htmx, which is pinned,
# does carry an SRI integrity hash.)
sonar.issue.ignore.multicriteria.e12.ruleKey=Web:S5725
sonar.issue.ignore.multicriteria.e12.resourceKey=gamgui/web/templates/base.html
# S6848 / S6847 — the drag-and-drop groups board attaches drag handlers to
# non-interactive cards/zones by design; that IS the affordance. Keyboard-form
# fallbacks for the same actions exist elsewhere on the screen.
sonar.issue.ignore.multicriteria.e13.ruleKey=Web:S6848
sonar.issue.ignore.multicriteria.e13.resourceKey=gamgui/web/templates/groups.html
sonar.issue.ignore.multicriteria.e14.ruleKey=Web:S6847
sonar.issue.ignore.multicriteria.e14.resourceKey=gamgui/web/templates/_board_members.html
# ItemTagNotWithinContainerTag — _command_row.html is an HTMX partial: it renders
# a single <li> that is swapped into a <ul> living in its parent template, so the
# container is present at runtime. False positive when the partial is linted alone.
sonar.issue.ignore.multicriteria.e15.ruleKey=Web:ItemTagNotWithinContainerTagCheck
sonar.issue.ignore.multicriteria.e15.resourceKey=gamgui/web/templates/_command_row.html