FilesExpand file tree

main

/

sonar-project.properties

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

119 lines (99 loc) · 5.16 KB

main

/

sonar-project.properties

Copy path

Top

File metadata and controls

• Code
• Blame

119 lines (99 loc) · 5.16 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

sonar.projectKey=liketrek_TREK

sonar.organization=liketrek

sonar.projectName=TREK

sonar.sourceEncoding=UTF-8

# Sources — one entry per workspace package (plugin-sdk is standalone but lives in-repo)

sonar.sources=client/src,server/src,shared/src,plugin-sdk/src

# Tests — dedicated test dirs per package, plus co-located client tests in src

# and co-located shared schema/sanitize/i18n specs in shared/src

sonar.tests=server/tests,client/tests,client/e2e,client/src,shared/src,plugin-sdk/test

sonar.test.inclusions=\

server/tests/**/*.test.ts,\

client/tests/**/*.test.ts,\

client/tests/**/*.test.tsx,\

client/e2e/**/*.spec.ts,\

client/src/**/*.test.ts,\

client/src/**/*.test.tsx,\

shared/src/**/*.spec.ts,\

plugin-sdk/test/**/*.test.ts

# Keep generated output and test files out of source analysis

sonar.exclusions=\

**/node_modules/**,\

**/dist/**,\

**/build/**,\

**/coverage/**,\

client/dev-dist/**,\

**/*.test.ts,\

**/*.test.tsx,\

**/*.spec.ts,\

**/*.d.ts

# Coverage — lcov paths relative to repo root, one per package

# (each package's vitest config emits lcov to <pkg>/coverage/).

sonar.javascript.lcov.reportPaths=\

server/coverage/lcov.info,\

client/coverage/lcov.info,\

shared/coverage/lcov.info,\

plugin-sdk/coverage/lcov.info

# Infrastructure/bootstrap files plus generated/data files the vitest configs

# exclude from instrumentation (a file absent from lcov would otherwise count

# as 0% covered here — keep these in sync with each package's vitest.config.ts)

sonar.coverage.exclusions=\

server/src/index.ts,\

server/src/config.ts,\

server/src/db/database.ts,\

server/src/db/migrations.ts,\

server/src/db/seeds.ts,\

server/src/demo/**,\

server/src/nest/plugins/runtime/plugin-host-entry.ts,\

server/assets/**,\

client/src/main.tsx,\

client/src/types.ts,\

shared/src/plugin-permissions.ts,\

shared/src/i18n/*/**,\

plugin-sdk/src/generated/**,\

plugin-sdk/src/lucide-icon-names.ts

# Locale files are large near-identical literal objects — keep them out of duplication metrics

sonar.cpd.exclusions=shared/src/i18n/**

# Only categorical, path-wide suppressions live here — cases where the rule can

# never meaningfully apply to anything in the path. Instance-specific findings

# (a handful of flagged lines in one file) are resolved as false positive /

# accepted / reviewed-safe on SonarCloud instead, so a future violation of the

# same rule in the same file still surfaces.

sonar.issue.ignore.multicriteria=i18nsec1,i18nsec2,i18nsec3,rand1,rand2,path1,empty2

# Locale files are UI copy — strings like "Password", "API key", "token" are

# labels, not credentials, and the secret detectors false-positive on them

# constantly. Ignore the secrets analyzer and the hard-coded-credential rules on

# the locale directories only (shared/src/i18n/*/** — the top-level code files

# such as languages.ts stay fully scanned).

sonar.issue.ignore.multicriteria.i18nsec1.ruleKey=secrets:*

sonar.issue.ignore.multicriteria.i18nsec1.resourceKey=shared/src/i18n/*/**

sonar.issue.ignore.multicriteria.i18nsec2.ruleKey=typescript:S2068

sonar.issue.ignore.multicriteria.i18nsec2.resourceKey=shared/src/i18n/*/**

sonar.issue.ignore.multicriteria.i18nsec3.ruleKey=typescript:S6418

sonar.issue.ignore.multicriteria.i18nsec3.resourceKey=shared/src/i18n/*/**

# S2245 (Math.random in a security context) — Studio + studioStore only: minting

# element and spread ids with Math.random is pervasive by design there (uid()

# helpers across the whole component tree), so per-instance marks would recur on

# every refactor. The ids live inside the photo-book document, stored and

# fetched as one blob scoped by journey id — the server never indexes, looks up

# or authorizes on an element or spread id. Worst case of a collision is

# documented in studioStore itself: two elements would share a selection.

sonar.issue.ignore.multicriteria.rand1.ruleKey=typescript:S2245

sonar.issue.ignore.multicriteria.rand1.resourceKey=client/src/components/Studio/**

sonar.issue.ignore.multicriteria.rand2.ruleKey=typescript:S2245

sonar.issue.ignore.multicriteria.rand2.resourceKey=client/src/store/studioStore.ts

# S4036 (OS command via PATH) — the plugin SDK is a CLI a plugin author runs on

# their own machine, and reaching git/gh/npm through the developer's own PATH is

# the point of it. Every child-process invocation passes an argv array with no

# shell, so nothing is shell-parsed. The one server-side site was NOT

# suppressed: it resolves its binary to an absolute path before spawning

# (see server/src/nest/booking-import/kitinerary-extractor.service.ts).

sonar.issue.ignore.multicriteria.path1.ruleKey=typescript:S4036

sonar.issue.ignore.multicriteria.path1.resourceKey=plugin-sdk/src/cli/**

# S4158 (empty collection accessed) — client/src/managed is a build-time seam:

# the arrays are empty in this repo and in every build of it, and an operator

# shipping extra screens replaces the file. Its header comment makes reading

# them unconditionally a rule, so the public build takes the same code path as

# a managed one.

sonar.issue.ignore.multicriteria.empty2.ruleKey=typescript:S4158

sonar.issue.ignore.multicriteria.empty2.resourceKey=client/src/managed/**