Skip to content

Sonar burn-down, mechanical batch: 98 findings, no behaviour change - #14

Merged
dgunter merged 2 commits into
mainfrom
chore/sonar-mechanical
Sep 4, 2026
Merged

Sonar burn-down, mechanical batch: 98 findings, no behaviour change#14
dgunter merged 2 commits into
mainfrom
chore/sonar-mechanical

Conversation

@dgunter

@dgunter dgunter commented Sep 4, 2026

Copy link
Copy Markdown
Owner

What

First of two SonarCloud burn-down passes on main (121 open, all maintainability). This PR takes the mechanical, behaviour-preserving 98 and leaves the 7 cognitive-complexity refactors (S3776) and 16 nested ternaries (S3358) for a separate reviewed pass, per the decision to accept those for now.

Backend

  • Tests: 60 composite assert a and b split into separate asserts (S9073); only the throwing call stays inside pytest.raises (S5778).
  • auth.py: /verify documents its 401/429/503 responses (S8415); redundant response_model= dropped on /session and /api/health (S8409). OpenAPI output verified unchanged.
  • parse.py: _as_str_tuple builds one list and returns once (S8495).

Frontend

  • Every component's props type wrapped in Readonly<> (S6759), including the shadcn ui/* components.
  • Stable list keys instead of array indexes (S6479): AST rows get a tree path from flattenAst; scope outline and other content rows use a small keyed() helper that suffixes repeated content rather than indexing.
  • String.raw for backslash-heavy literals (S7780), replaceAll (S7781), SubmitEvent for the deprecated FormEvent (S1874), un-nested template literal in AttackCard (S4624), useless ?? {} spread removed (S7744).
  • tsconfig.node.json is strict JSON again (json:S2260).

Other: deploy.sh uses [[ ]] for the health-check test (S7688).

Verification

  • Backend: pytest 201 passed.
  • Frontend: tsc --noEmit clean, vitest 20 passed (one new test for keyed()).
  • The SonarCloud PR comment below should show the new-code gate and no new issues; the follow-up analysis on main after merge should drop from 121 to roughly 23.

🤖 Generated with Claude Code

Backend
- tests: split 60 composite `assert a and b` into separate asserts (S9073);
  keep only the throwing call inside pytest.raises (S5778).
- auth: document the 401/429/503 HTTPExceptions on /verify via
  `responses=` (S8415); drop `response_model=` where it duplicates the
  return annotation on /session and /api/health (S8409).
- parse: `_as_str_tuple` builds one list and returns once (S8495).

Frontend
- Wrap every component's props type in Readonly<> (S6759), including the
  shadcn ui/* components.
- Stable list keys instead of array indexes (S6479): AST rows carry a tree
  path from flattenAst; scope outline and other content rows use a small
  `keyed()` helper that suffixes repeated content instead of indexing.
- String.raw for backslash-heavy literals (S7780), replaceAll over
  regex replace (S7781), SubmitEvent instead of the deprecated FormEvent
  (S1874), un-nest a template literal in AttackCard (S4624), drop a
  useless `?? {}` spread in api.ts (S7744).
- tsconfig.node.json: remove the /* */ comments so it is strict JSON
  (json:S2260).

deploy.sh: `[[ ]]` for the health-check test (S7688).

Left for a later pass, by decision: the seven cognitive-complexity
refactors (S3776) and the sixteen nested ternaries (S3358).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown

SonarCloud analysis · PR #14

Quality gate: ❌ Failed · Open in SonarCloud

Condition Actual Required Status
Reliability rating (new code) A ≤ A
Security rating (new code) A ≤ A
Maintainability rating (new code) A ≤ A
Coverage (new code) 31.8% ≥ 80.0%
Duplication (new code) 0.0% ≤ 3.0%
Security hotspots reviewed 100.0% ≥ 100.0%

Open issues on new code: 0

No open issues on the changed code. 🎉

Commit 4e198b1d4362 · analysis task · posted by the Build workflow; edited in place on every push.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@dgunter
dgunter merged commit 49df25b into main Sep 4, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant