mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
7ee5bbc64d
* fix(build): spawn npx.cmd through a shell in the electron better-sqlite3 rebuild Node's CVE-2024-27980 hardening makes spawnSync of .cmd/.bat shims fail with status null unless shell:true — the v3.8.47 tag build died on the Windows job with 'better-sqlite3 rebuild against electron 43.1.0 failed (exit null)'. Extracted the spawn plan into electronRebuildPlan.mjs (pure, import-safe) with a regression test; args are fixed literals, no untrusted input reaches the shell. * fix(build): ship head-response-guard.cjs in the npm tarball (#7065) The prepublish prune allowlist (pack-artifact-policy.ts) lacked head-response-guard.cjs, so assembleStandalone copied it and the prune deleted it — every boot of the published 3.8.47 crashed with ERR_MODULE_NOT_FOUND (3rd occurrence of this class; tls-options/3.8.41). Also added to PACK_ARTIFACT_REQUIRED_PATHS so check:pack-artifact fails loudly, plus a closure test that derives every server-ws.mjs sibling import and asserts both lists cover it. * fix(ci): zero the Sonar quality-gate findings on new code - ci.yml sonarqube job: download the coverage artifact into coverage/ so lcov.info lands where sonar.javascript.lcov.reportPaths points — the upload strips the common coverage/ prefix, so 'path: .' left new-code coverage at 0% on every scan - kiro auto-import: await the async isCloudEnabled() gate (S6544 — a bare truthiness check on the Promise made syncToCloud run even with cloud sync disabled) - stream.ts: real JSON fallback in the reasoning-split clone (S3923 — both ternary branches called structuredClone, the promised fallback was dead) - codex executor: handle the async reader.cancel() rejection (S4822) - deterministic localeCompare sorts (S2871 x2) - classify-pr-changes.mjs: confine the argv list file to the workspace (jssecurity:S8707 path-traversal guard) + behavioral tests - Dockerfile: rebuild better-sqlite3 with npm's bundled node-gyp instead of npx --yes (docker:S6505 — no on-demand registry install) * chore(ci): make the Sonar quality gate informational (wait=false) The org's SonarCloud FREE plan cannot associate a custom quality gate — only the built-in Sonar way (80% new coverage) applies, which no full-cycle release PR can realistically meet. The scan still uploads (dashboard, PR decoration); the CI job just no longer fails on the gate. A tuned 'OmniRoute way' gate (coverage >=60, duplication <=5) is already configured in the org for the day the plan is upgraded — re-enable wait=true then. * chore(release): v3.8.48 hotfix bump + changelog (npm 3.8.47 unbootable, #7065) * test: align pack-artifact + dockerfile guards to the corrected contracts pack-artifact-policy.test.ts encoded the pre-#7065 REQUIRED list (without head-response-guard.cjs) and dockerfile-better-sqlite3-node-gyp-6700.test.ts asserted the npx invocation the Sonar fix replaced with npm's bundled node-gyp — both now assert the corrected behavior.
73 lines
4.4 KiB
Properties
73 lines
4.4 KiB
Properties
sonar.projectKey=diegosouzapw_OmniRoute
|
||
sonar.organization=diegosouzapw
|
||
sonar.sourceEncoding=UTF-8
|
||
sonar.sources=src,open-sse,scripts,bin,next.config.mjs,Dockerfile
|
||
sonar.tests=tests
|
||
sonar.test.inclusions=tests/**/*.test.ts,tests/**/*.spec.ts
|
||
sonar.exclusions=tests/**,src/i18n/messages/**,docs/**,coverage/**,.next/**,dist/**,build/**,node_modules/**
|
||
sonar.javascript.lcov.reportPaths=coverage/lcov.info
|
||
|
||
# ── "Clean as You Code" — new-code quality gate ───────────────────────────
|
||
# New code must not introduce any bug, vulnerability, hotspot or code smell.
|
||
# Legacy code is grandfathered (sonar.newCode.referenceBranch baseline).
|
||
#
|
||
# OPERATIONAL PRE-REQUISITES (owner action required before the gate is live):
|
||
# 1. Set repository secret SONAR_TOKEN (user/project token from SonarQube UI).
|
||
# 2. Set repository secret SONAR_HOST_URL (e.g. https://sonar.example.com for
|
||
# a self-hosted Community Build instance, or https://sonarcloud.io for the
|
||
# cloud plan).
|
||
# 3. Ensure the `sonarqube` job in `.github/workflows/ci.yml` passes both
|
||
# secrets to the SonarScanner step as environment variables; without them
|
||
# the step is a no-op (secrets-gated).
|
||
# 4. Configure the "Clean as You Code" Quality Gate in the SonarQube project
|
||
# settings (Conditions → New Code: Bugs=0, Vulnerabilities=0,
|
||
# Security Hotspots Reviewed=100%, Code Smells=0 or bounded).
|
||
#
|
||
# sonar.qualitygate.wait: when true the scanner polls the gate result and fails
|
||
# the CI step when the gate is RED. Set to false (informational mode,
|
||
# owner-decided 2026-07-13): the org is on the SonarCloud FREE plan, which
|
||
# cannot associate a custom gate — only the built-in "Sonar way" (80% new
|
||
# coverage) applies, and that threshold is unrealistic for full-cycle release
|
||
# PRs. A tuned gate ("OmniRoute way": coverage ≥60 aligned with the repo's
|
||
# floor, duplication ≤5) already exists in the org, ready to be associated if
|
||
# the plan is ever upgraded — flip this back to true at the same time.
|
||
sonar.qualitygate.wait=false
|
||
|
||
# New-code baseline: compare against the tip of the release branch so that
|
||
# every PR against release/* is judged as "new code vs release baseline".
|
||
# Override with sonar.newCode.referenceBranch on a per-branch basis if needed.
|
||
sonar.newCode.referenceBranch=main
|
||
|
||
# ── Hotspot suppressions ───────────────────────────────────────────────────
|
||
# The following rules surface "review this" hotspots that are bounded /
|
||
# non-security contexts in this codebase:
|
||
# S5852 – Regex with super-linear backtracking. All matched call sites
|
||
# use bounded character classes (e.g. `[^\]]+`) — no catastrophic
|
||
# backtracking is possible.
|
||
# S2245 – pseudo-random `Math.random()`. The few remaining call sites are
|
||
# for non-security purposes (request IDs / jitter), never for
|
||
# tokens, secrets, or session material.
|
||
# S4036 – PATH lookups via `command -v` / `which`. The CLI helper resolves
|
||
# tooling on the user's own machine; running with their PATH is
|
||
# intentional and matches the behaviour of every other CLI on the
|
||
# system.
|
||
# S1523 – Dynamic code execution. SCOPED to src/lib/plugins/pluginWorker.ts
|
||
# only: running plugin source IS the worker's purpose, and it does so
|
||
# inside a hardened Node `vm` sandbox (vm.createContext, a require
|
||
# allow-list of just `crypto`, and a 10s execution timeout). Not
|
||
# `eval`/`new Function` (Hard Rule #3). S1523 stays active everywhere
|
||
# else so a genuine dynamic-exec elsewhere is still flagged.
|
||
sonar.issue.ignore.multicriteria=h1,h2,h3,h4,h5,h6
|
||
sonar.issue.ignore.multicriteria.h1.ruleKey=javascript:S5852
|
||
sonar.issue.ignore.multicriteria.h1.resourceKey=**/*
|
||
sonar.issue.ignore.multicriteria.h2.ruleKey=typescript:S5852
|
||
sonar.issue.ignore.multicriteria.h2.resourceKey=**/*
|
||
sonar.issue.ignore.multicriteria.h3.ruleKey=typescript:S2245
|
||
sonar.issue.ignore.multicriteria.h3.resourceKey=**/*
|
||
sonar.issue.ignore.multicriteria.h4.ruleKey=javascript:S4036
|
||
sonar.issue.ignore.multicriteria.h4.resourceKey=**/*
|
||
sonar.issue.ignore.multicriteria.h5.ruleKey=typescript:S4036
|
||
sonar.issue.ignore.multicriteria.h5.resourceKey=**/*
|
||
sonar.issue.ignore.multicriteria.h6.ruleKey=typescript:S1523
|
||
sonar.issue.ignore.multicriteria.h6.resourceKey=**/pluginWorker.ts
|