sonar-project.properties

Rama main · réplica de lectura del repositorio original.

# SonarCloud Configuration
sonar.projectKey=bobbyquantum_inkweld
sonar.organization=bobbyquantum

# Sources and tests
sonar.sources=.
sonar.tests=backend/test,frontend/src,frontend/e2e,packages/inkweld-prosemirror/test,packages/inkweld-presence/test,packages/inkweld-async/test,packages/inkweld-canvas/test,packages/inkweld-project-library/test
sonar.test.inclusions=**/*.spec.ts,**/*.test.ts,**/e2e/**

# Exclusions (only generated/vendored code and test files)
sonar.exclusions=**/node_modules/**,**/dist/**,**/coverage/**,frontend/src/api-client/**,**/*.spec.ts,**/*.test.ts,**/e2e/**,scripts/**,backend/scripts/**,frontend/scripts/**

# Exclude test infrastructure and files excluded from Bun/Vitest coverage (keeps other Sonar checks active)
# Keep in sync with backend/bunfig.toml coveragePathIgnorePatterns
sonar.coverage.exclusions=\
  frontend/setup-vitest.ts,\
  frontend/src/**/*.html,\
  frontend/src/**/*.scss,\
  frontend/src/testing/**,\
  frontend/src/app/**/testing/**,\
  frontend/src/environments/**,\
  frontend/src/main.ts,\
  frontend/src/**/*.d.ts,\
  frontend/src/**/*.stories.ts,\
  frontend/src/**/index.ts,\
  frontend/src/**/element-sync-provider.interface.ts,\
  frontend/src/**/correction-dto.extension.ts,\
  frontend/src/**/tag.model.ts,\
  **/test-credentials.ts,\
  **/scripts/**,\
  **/test/**,\
  **/mcp/**,\
  **/durable-objects/yjs-project.do.ts,\
  **/yjs-worker.service.ts,\
  **/fal-model-metadata.service.ts,\
  **/reference-image-loader.ts,\
  **/openai-lint.service.ts,\
  **/db/schema/*.ts,\
  **/db/bun-sqlite.ts,\
  **/db/index.ts,\
  **/config/default-text-models.ts,\
  **/types/image-generation.ts,\
  **/bun-app.ts,\
  **/bun-runner.ts,\
  **/node-runner.ts,\
  **/document-element-editor.component.ts,\
  **/document.service.ts,\
  docs/**,\
  frontend/playwright*.config.ts,\
  frontend/vitest*.config.ts,\
  frontend/eslint-template-parser-compat.mjs,\
  frontend/functions/**,\
  backend/src/setup-wizard.ts,\
  backend/src/worker-app.ts,\
  backend/src/node-app.ts,\
  backend/src/config/runtime.ts,\
  **/db/better-sqlite.ts,\
  **/db/d1.ts,\
  **/database.better-sqlite.middleware.ts,\
  **/database.d1.middleware.ts

# Exclude intentionally duplicated cross-runtime utilities from copy-paste detection.
# backend and frontend can't share source files across build systems (Bun vs Angular/Node).
sonar.cpd.exclusions=**/utils/string-utils.ts,**/timeline-era-dialog.component.ts,**/timeline-event-dialog.component.ts

# Coverage reports (LCOV format)
sonar.javascript.lcov.reportPaths=frontend/coverage/inkweld-frontend/lcov.info,backend/coverage/lcov.info,packages/inkweld-prosemirror/coverage/lcov.info,packages/inkweld-presence/coverage/lcov.info,packages/inkweld-async/coverage/lcov.info,packages/inkweld-canvas/coverage/lcov.info,packages/inkweld-project-library/coverage/lcov.info

# TypeScript
sonar.typescript.tsconfigPaths=frontend/tsconfig.json,backend/tsconfig.json,packages/inkweld-prosemirror/tsconfig.json,packages/inkweld-presence/tsconfig.json,packages/inkweld-async/tsconfig.json,packages/inkweld-canvas/tsconfig.json,packages/inkweld-project-library/tsconfig.json

# Disable PL/SQL analyzer (no Oracle DB in this project)
sonar.plsql.file.suffixes=none

# Suppress hardcoded-credentials rule (S2068) on centralised test credential files only.
# These files contain intentionally fake/test-only values — not real secrets.
sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5
sonar.issue.ignore.multicriteria.e1.ruleKey=typescript:S2068
sonar.issue.ignore.multicriteria.e1.resourceKey=**/test-credentials.ts
# Suppress "prefer node: prefix" rule — project uses bare imports (fs, path) by convention.
sonar.issue.ignore.multicriteria.e2.ruleKey=typescript:S7772
sonar.issue.ignore.multicriteria.e2.resourceKey=**/*.ts
# Suppress "Omitting --ignore-scripts" (S6505) on install steps in CI workflows
# and the manual deploy script. Several production dependencies (esbuild,
# workerd, sharp) require their postinstall hooks to download platform-specific
# native binaries, and the root package.json's postinstall bootstraps the
# sub-workspace installs. The Dockerfile uses --ignore-scripts in its stages
# and runs the required postinstalls explicitly; that pattern is impractical
# in workflow YAML where every job would need to re-install three workspaces.
# Lockfile integrity is still enforced via --frozen-lockfile on every site.
sonar.issue.ignore.multicriteria.e3.ruleKey=githubactions:S6505
sonar.issue.ignore.multicriteria.e3.resourceKey=.github/workflows/*.yml
sonar.issue.ignore.multicriteria.e4.ruleKey=shell:S6505
sonar.issue.ignore.multicriteria.e4.resourceKey=docs/deploy-docs.sh
# S8543 ("Using dependencies without locking resolved versions") on bun install
# lines — already mitigated by --frozen-lockfile + bun.lock committed, but Sonar
# does not recognise --frozen-lockfile as a lock-enforcing flag for bun.
sonar.issue.ignore.multicriteria.e5.ruleKey=githubactions:S8543
sonar.issue.ignore.multicriteria.e5.resourceKey=.github/workflows/*.yml