-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathsonar-project.properties
More file actions
45 lines (43 loc) · 2.83 KB
/
Copy pathsonar-project.properties
File metadata and controls
45 lines (43 loc) · 2.83 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
# This project is analyzed in GitHub Actions rather than by SonarQube Cloud's
# Automatic Analysis: only an explicit analysis can import Python coverage.
sonar.projectKey=gitkodak_unifi-map
sonar.organization=gitkodak
sonar.sources=src,scripts,.clusterfuzzlite,.github,pyproject.toml
sonar.tests=tests
sonar.python.version=3.11,3.12,3.13
sonar.python.coverage.reportPaths=coverage.xml
# The report deliberately measures the installable package; repository utility
# scripts -- and the fuzzing harness/build config, same category -- are still
# analyzed, but do not distort the application's coverage. Neither runs under
# pytest, so without this every line in both would show as uncovered.
sonar.coverage.exclusions=scripts/**,.clusterfuzzlite/**
# ci.yml's "Install" step's local package line (pip install --no-deps
# --only-binary=:all: -e .) is flagged by githubactions:S8541/S8544 as
# unpinned/not-binary-only. Both are false positives that cannot be fixed by
# changing the command: -e (editable) is what lets pytest-cov's coverage.xml
# report paths under src/unifi_map/ rather than a site-packages copy, which
# is what sonar.coverage.exclusions above and sonar.sources up top actually
# depend on -- verified directly: dropping -e moves every filename in
# coverage.xml to site-packages/unifi_map/..., which breaks the coverage
# import entirely. --only-binary=:all: cannot apply to an editable local
# install regardless (there is no prebuilt wheel for a live-linked path),
# which is what the rule is actually detecting; it just cannot tell that
# apart from a real unpinned third-party fetch. The same false positive on
# .clusterfuzzlite/build.sh's near-identical non-editable line was dismissed
# on GitHub as a false positive (code-scanning alert #14) for the same
# underlying reason: nothing here is a fetched dependency to pin or hash.
sonar.issue.ignore.multicriteria=e1,e2,e3
sonar.issue.ignore.multicriteria.e1.ruleKey=githubactions:S8541
sonar.issue.ignore.multicriteria.e1.resourceKey=.github/workflows/ci.yml
sonar.issue.ignore.multicriteria.e2.ruleKey=githubactions:S8544
sonar.issue.ignore.multicriteria.e2.resourceKey=.github/workflows/ci.yml
# .clusterfuzzlite/Dockerfile running as root (docker:S6471) is not a false
# positive the way the two above are -- the finding is accurate, the image
# really does run as root -- but it is accepted rather than fixable: the
# Dockerfile's own comment above FROM explains why (oss-fuzz-base's build
# tooling assumes it, the image is never published, it exists only for the
# minutes this job runs). That comment alone does not resolve the Sonar
# issue, which is what left it open and capping the security rating at B
# after it was believed settled. This entry is what actually closes it.
sonar.issue.ignore.multicriteria.e3.ruleKey=docker:S6471
sonar.issue.ignore.multicriteria.e3.resourceKey=.clusterfuzzlite/Dockerfile