From af26ce1a6b814956b72fb0a5ced034b908aa1629 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 13 Nov 2026 12:17:21 +0000 Subject: [PATCH 1/3] ci: provide pinned test data to Sonar coverage --- .github/workflows/sonarcloud.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index e78fe1ea3..32b0507f6 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -16,6 +16,11 @@ concurrency: jobs: sonarcloud: - # Tracked at @main so org-wide CI improvements propagate without PR churn. - uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main + # Pin the coverage setup that checks out this repo's pinned craft-i18n data. + uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@20ebee3cb1eef69f886b98d566aa07552ee0196f + with: + # The shared coverage archive's shards omit the CLI executable used by integration tests. + # Run this repository's suite in one instrumented job and provide its pinned test data. + shards: 1 + fonts-ref: 37827adc41fd165f9a9234ac40f94dbad353aa69 secrets: inherit From eb660e776ef4d9de5e22300ea85a268c876de76e Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 13 Nov 2026 13:03:44 +0000 Subject: [PATCH 2/3] ci: use shared instrumented test failure gate --- .github/workflows/sonarcloud.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 32b0507f6..50616c871 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -17,7 +17,7 @@ concurrency: jobs: sonarcloud: # Pin the coverage setup that checks out this repo's pinned craft-i18n data. - uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@20ebee3cb1eef69f886b98d566aa07552ee0196f + uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@ea24c9c24e1997238334182160f60e602e5bce32 with: # The shared coverage archive's shards omit the CLI executable used by integration tests. # Run this repository's suite in one instrumented job and provide its pinned test data. From 4084642c450869b607a4619b815ceaf43587229a Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 13 Nov 2026 13:24:26 +0000 Subject: [PATCH 3/3] ci: exclude pinned fonts from Sonar scan --- sonar-project.properties | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sonar-project.properties b/sonar-project.properties index 5f58f42ae..7bd9e8ce6 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -1,6 +1,9 @@ sonar.projectKey=storytold_figcraft sonar.organization=storytold +# Pinned integration-test fonts are data, not source code for analysis. +sonar.exclusions=craft-fonts/** + # S4790 (weak hash): a .fig file names each image by the SHA-1 of its bytes (20 bytes, the only # length readers accept). It is an identifier the format fixes, not a security choice. sonar.issue.ignore.multicriteria=fig_image_sha1