mirror of
https://github.com/storytold/artcraft.git
synced 2026-11-12 04:42:16 +00:00
Dylan M. Taylor
0c11395467
Clears the open SonarCloud issues outside the TypeScript frontend, except the Rust ones, which moved to #2823 so each PR stays small. Compile and tests are left to CI. **Security** - `frontend/api_docs.html` (Web:S5725): `integrity` (sha384 of the pinned `swagger-ui-dist@5.32.0` files) and `crossorigin="anonymous"` on the three unpkg assets, over `https:`. - S6505: `--ignore-scripts` on `npm install` / `npm ci` in the dev and build scripts and in the macOS and Windows publish workflows. `artcraft-linux-publish.yml` already builds with `npm ci --ignore-scripts`, and the frontend has no install scripts of its own. - S7637: `dtolnay/rust-toolchain@stable` and `tauri-apps/tauri-action@v0` pinned by commit SHA. For tauri-action that's the commit `v0` points to (`84b9d35…`). The Linux workflow had pinned the tag object instead, and is fixed the same way. - S6505 / S8543: the macOS build runs `./node_modules/.bin/nx` instead of `npx nx`, as the Linux workflow does. **Reliability** - shell:S7688: `[[ ]]` in place of `[` / `test` in `frontend_preflight.sh` and the Linux packaging scripts. **Analysis scope** (`sonar-project.properties`), each with its reason in the file: - Not analysed: `crates/vendor/**` (third-party), the upstream Python reference implementations beside the Grok and Sora clients (nothing runs them), and the hand-run developer tools `frontend/scripts/unix-dev.mjs` and `frontend/tools/performance/**`. These held the S8564, S1244, S2245, S4036, S5443 and S8707 findings. - rust:S4347 not raised on `DeterministicRng`, the fixed-seed generator for tests. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Improvements** * File downloads and database maintenance now use asynchronous operations, helping the app remain responsive during these tasks. * API documentation assets load over HTTPS with integrity checks. * **Build and Reliability** * Build and publishing workflows use pinned tool versions and skip package lifecycle scripts during dependency installation. * Linux packaging checks use consistent shell conditionals. * Frontend builds use the locally installed Nx command where applicable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> - typescript:S2187 not raised on the ApiManager tests, which build their cases with shared helpers that call `it` (`BetaKeysApi.test.ts`). typescript:S2819 not raised on `*.worker.ts`: a dedicated worker's messages come only from the page that started it.
32 lines
2.1 KiB
Properties
32 lines
2.1 KiB
Properties
sonar.projectKey=storytold_artcraft
|
|
sonar.organization=storytold
|
|
|
|
# CI only publishes the Rust lcov report, so TypeScript and JavaScript never
|
|
# appear covered. Same idea as anicraft excluding JS/PowerShell/Python, and
|
|
# as filmcraft and lightcraft excluding tools/docs/examples.
|
|
sonar.coverage.exclusions=**/*.ts,**/*.tsx,**/*.js,**/*.jsx
|
|
|
|
|
|
# Not analysed: code that isn't ArtCraft's or isn't run by the app or CI.
|
|
# - crates/vendor/: third-party crates kept in the tree.
|
|
# - The Python beside the Grok and Sora clients: the upstream reference implementations the Rust ports
|
|
# cite ("Based on Grok-Api/core/xctid.py"); nothing runs them.
|
|
# - frontend/scripts/unix-dev.mjs and frontend/tools/performance/: developer tools run by hand
|
|
# (script/artcraft/unix_dev.sh, `npm run perf:desktop`); they start git, cargo and a browser from
|
|
# the developer's own PATH and write where the developer says.
|
|
sonar.exclusions=crates/vendor/**,crates/api_clients/grok_consumer_client/src/credentials/_metadata/**,crates/api_clients/openai_sora_client/src/requests/auth_sentinel_2/metadata/python_impl/**,frontend/scripts/unix-dev.mjs,frontend/tools/performance/**
|
|
|
|
# S4347 (predictable seed): DeterministicRng is the fixed-seed generator for tests and dev seed
|
|
# tools; being reproducible is its purpose.
|
|
# S2187 (file without tests): the API tests build their cases with the shared helpers in
|
|
# test/app/Classes/ApiManager/utils/, which call `it` themselves.
|
|
# S2819 (message origin): a dedicated worker's `message` events come only from the page that
|
|
# started it; they carry no origin to check.
|
|
sonar.issue.ignore.multicriteria=deterministic_rng,api_test_helpers,worker_messages
|
|
sonar.issue.ignore.multicriteria.deterministic_rng.ruleKey=rust:S4347
|
|
sonar.issue.ignore.multicriteria.deterministic_rng.resourceKey=crates/schema/public/tokens/src/deterministic_rng.rs
|
|
sonar.issue.ignore.multicriteria.api_test_helpers.ruleKey=typescript:S2187
|
|
sonar.issue.ignore.multicriteria.api_test_helpers.resourceKey=frontend/apps/artcraft/test/app/Classes/ApiManager/**
|
|
sonar.issue.ignore.multicriteria.worker_messages.ruleKey=typescript:S2819
|
|
sonar.issue.ignore.multicriteria.worker_messages.resourceKey=**/*.worker.ts
|