OmniRoute/sonar-project.properties at main · sub4biz/OmniRoute · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
sonar.projectKey=diegosouzapw_OmniRoute
sonar.organization=diegosouzapw
sonar.sourceEncoding=UTF-8
sonar.sources=src,open-sse,scripts,bin,next.config.mjs,Dockerfile
sonar.tests=tests
sonar.test.inclusions=tests/**/*.test.ts,tests/**/*.spec.ts
sonar.exclusions=tests/**,src/i18n/messages/**,docs/**,coverage/**,.next/**,dist/**,build/**,node_modules/**
sonar.javascript.lcov.reportPaths=coverage/lcov.info

# ── "Clean as You Code" — new-code quality gate ───────────────────────────
# New code must not introduce any bug, vulnerability, hotspot or code smell.
# Legacy code is grandfathered (sonar.newCode.referenceBranch baseline).
#
# OPERATIONAL PRE-REQUISITES (owner action required before the gate is live):
#   1. Set repository secret SONAR_TOKEN  (user/project token from SonarQube UI).
#   2. Set repository secret SONAR_HOST_URL  (e.g. https://sonar.example.com for
#      a self-hosted Community Build instance, or https://sonarcloud.io for the
#      cloud plan).
#   3. Ensure the `sonarqube` job in `.github/workflows/ci.yml` passes both
#      secrets to the SonarScanner step as environment variables; without them
#      the step is a no-op (secrets-gated).
#   4. Configure the "Clean as You Code" Quality Gate in the SonarQube project
#      settings (Conditions → New Code: Bugs=0, Vulnerabilities=0,
#      Security Hotspots Reviewed=100%, Code Smells=0 or bounded).
#
# sonar.qualitygate.wait: when true the scanner polls the gate result and fails
# the CI step when the gate is RED. Set to false (informational mode,
# owner-decided 2026-07-13): the org is on the SonarCloud FREE plan, which
# cannot associate a custom gate — only the built-in "Sonar way" (80% new
# coverage) applies, and that threshold is unrealistic for full-cycle release
# PRs. A tuned gate ("OmniRoute way": coverage ≥60 aligned with the repo's
# floor, duplication ≤5) already exists in the org, ready to be associated if
# the plan is ever upgraded — flip this back to true at the same time.
sonar.qualitygate.wait=false

# New-code baseline: compare against the tip of the release branch so that
# every PR against release/* is judged as "new code vs release baseline".
# Override with sonar.newCode.referenceBranch on a per-branch basis if needed.
sonar.newCode.referenceBranch=main

# ── Hotspot suppressions ───────────────────────────────────────────────────
# The following rules surface "review this" hotspots that are bounded /
# non-security contexts in this codebase:
#   S5852  – Regex with super-linear backtracking. All matched call sites
#            use bounded character classes (e.g. `[^\]]+`) — no catastrophic
#            backtracking is possible.
#   S2245  – pseudo-random `Math.random()`. The few remaining call sites are
#            for non-security purposes (request IDs / jitter), never for
#            tokens, secrets, or session material.
#   S4036  – PATH lookups via `command -v` / `which`. The CLI helper resolves
#            tooling on the user's own machine; running with their PATH is
#            intentional and matches the behaviour of every other CLI on the
#            system.
#   S1523  – Dynamic code execution. SCOPED to src/lib/plugins/pluginWorker.ts
#            only: running plugin source IS the worker's purpose, and it does so
#            inside a hardened Node `vm` sandbox (vm.createContext, a require
#            allow-list of just `crypto`, and a 10s execution timeout). Not
#            `eval`/`new Function` (Hard Rule #3). S1523 stays active everywhere
#            else so a genuine dynamic-exec elsewhere is still flagged.
sonar.issue.ignore.multicriteria=h1,h2,h3,h4,h5,h6
sonar.issue.ignore.multicriteria.h1.ruleKey=javascript:S5852
sonar.issue.ignore.multicriteria.h1.resourceKey=**/*
sonar.issue.ignore.multicriteria.h2.ruleKey=typescript:S5852
sonar.issue.ignore.multicriteria.h2.resourceKey=**/*
sonar.issue.ignore.multicriteria.h3.ruleKey=typescript:S2245
sonar.issue.ignore.multicriteria.h3.resourceKey=**/*
sonar.issue.ignore.multicriteria.h4.ruleKey=javascript:S4036
sonar.issue.ignore.multicriteria.h4.resourceKey=**/*
sonar.issue.ignore.multicriteria.h5.ruleKey=typescript:S4036
sonar.issue.ignore.multicriteria.h5.resourceKey=**/*
sonar.issue.ignore.multicriteria.h6.ruleKey=typescript:S1523
sonar.issue.ignore.multicriteria.h6.resourceKey=**/pluginWorker.ts