fix(sonar): skip SonarCloud analysis on template repo (#80)

* fix(sonar): skip SonarCloud analysis on template repo

Remove `.github/workflows/sonarcloud.yml` and root-level
`sonar-project.properties`. As Jinja2 meta-code, this template body is not
statically analyzable as Python, and the analysis was failing with a curl
403 from the SonarCloud quality-gate API (the project key was effectively
unanalyzable: source paths like `{{cookiecutter.project_slug}}/` are literal
text on the template-repo side and only become real directories in the
rendered child project).

Generated child projects continue to opt into their own SonarCloud
analysis via the rendered `sonar-project.properties` and `sonarcloud.yml`
workflow that ship inside the template's rendered output directory; that
analysis is unaffected because it runs after cookiecutter has rendered
the placeholders.

Refs: Phase 3 Bucket E (CI Repair Sprint)

* fix(docs): remove stale SonarCloud references after sonarcloud.yml deletion

- README.md: drop SonarCloud badges; update setup section to reflect that
  the template repo is excluded from analysis (Jinja2 placeholders are not
  statically analyzable as Python)
- CLAUDE.md: remove Template Repository subsection from SonarCloud section;
  retain Generated Projects subsection unchanged
- ci.yml: drop SonarQube feature line from header; update Layer 3 description
  to Ruff/BasedPyright/Bandit to match actual toolchain
- CHANGELOG.md: reorder [Unreleased] subsections to Added, Changed, Removed,
  Fixed per Keep a Changelog 1.1.0 spec (Removed was misplaced before Changed)
- CONTRIBUTING.md: replace SonarCloud with qlty in automated reviewers list
- .sonarlint/connectedMode.json: delete orphaned IDE config pointing to the
  now-deleted analysis project (caused SonarLint connection errors)
- .secrets.baseline: add SHA-pin entries from .pre-commit-config.yaml that
  were false-positived as high-entropy secrets

Author: williaby

.github/workflows/ci.yml

@@ -3,15 +3,14 @@
 #
 # Features:
 #   - Standard quality checks (tests, linting, type checking)
-#   - SonarQube quality gate enforcement
 #   - LLM anti-pattern detection
 #   - Assumption tag verification
 #   - Security scanning
 #
 # Three-Layer Governance:
 #   Layer 1: Production Runtime Risks (RAD tags)
 #   Layer 2: LLM Development Debt (LLM tags)
-#   Layer 3: Automated Code Quality (SonarQube)
+#   Layer 3: Automated Code Quality (Ruff, BasedPyright, Bandit)
 
 name: CI
 
@@ -289,12 +288,11 @@ jobs:
   # ============================================================================
   # Job 3: Template Validation
   # ----------------------------------------------------------------------------
-  # Note: SonarCloud scanning + quality gate are handled by the dedicated
-  # sonarcloud.yml workflow (thin caller for the org reusable workflow at
-  # ByronWilliamsCPA/.github/.github/workflows/python-sonarcloud.yml). A second
-  # inline scan here caused two concurrent analyses for the same projectKey on
-  # the same SHA, racing each other and producing the 'task not found' 404 from
-  # sonarqube-quality-gate-action. See PR #69.
+  # Note: SonarCloud analysis is intentionally NOT run on this template repo.
+  # As meta-code (Jinja2 placeholders rendered at instantiation time), the
+  # template body is not analyzable as plain Python. Generated child projects
+  # opt into their own SonarCloud analysis via the rendered config that ships
+  # inside the rendered template directory.
   # ============================================================================
   validate-template:
     name: Validate Cookiecutter Template
@@ -391,7 +389,6 @@ jobs:
           echo "All governance layers checked:" >> $GITHUB_STEP_SUMMARY
           echo "- ✅ Code Quality Checks" >> $GITHUB_STEP_SUMMARY
           echo "- ✅ LLM Governance Validation" >> $GITHUB_STEP_SUMMARY
-          echo "- ✅ SonarCloud Analysis (via reusable workflow)" >> $GITHUB_STEP_SUMMARY
           echo "- ✅ Template Validation" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Status: ${{ job.status }}**" >> $GITHUB_STEP_SUMMARY

.github/workflows/sonarcloud.yml

@@ -133,13 +133,85 @@
     }
   ],
   "results": {
+    ".pre-commit-config.yaml": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "a6a0ba7241c2c0e8d2cb5980e4ebad99a38c4fc0",
+        "is_verified": false,
+        "line_number": 8
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "86242b7a7b67c1fd83514757a6b319602d648e94",
+        "is_verified": false,
+        "line_number": 28
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "32772e0f64714ee37c2509aa0a3ce917c5735cc6",
+        "is_verified": false,
+        "line_number": 43
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "ae599e2a19541d5442ce8d183650de9a35d2a78e",
+        "is_verified": false,
+        "line_number": 121
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "822f2dce9fa345f45a618777dd8de8f183ddfdef",
+        "is_verified": false,
+        "line_number": 139
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "5dc0a1cf00984ab9cbef49ac562ee6c48eea0674",
+        "is_verified": false,
+        "line_number": 147
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "beab4aad95563277a5a01fcf6e88a9a9d1bb6e9c",
+        "is_verified": false,
+        "line_number": 155
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "87f016410622dea3d25d65e5ef2e4fdad42fdb1d",
+        "is_verified": false,
+        "line_number": 163
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "d1d759c99cc716d64322cd46f7ed6c0ccd561e8d",
+        "is_verified": false,
+        "line_number": 170
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "6327141e0d23f165d2d00ce64fea19a4d95d625d",
+        "is_verified": false,
+        "line_number": 182
+      }
+    ],
     "README.md": [
       {
         "type": "Secret Keyword",
         "filename": "README.md",
         "hashed_secret": "f7485c89e918d73cb3096af4ff0b916a27bf9a5d",
         "is_verified": false,
-        "line_number": 327
+        "line_number": 317
       }
     ],
     "central-services/auth-service/README.md": [
@@ -234,5 +306,5 @@
       }
     ]
   },
-  "generated_at": "2026-05-20T04:32:31Z"
+  "generated_at": "2026-05-28T01:59:41Z"
 }

.secrets.baseline

@@ -114,6 +114,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Root `pyproject.toml`: added missing `A` (flake8-builtins) and `PT`
   (flake8-pytest-style) rule sets to `[tool.ruff.lint].select`
 
+### Removed
+
+- Root-level `sonar-project.properties` and `.github/workflows/sonarcloud.yml`
+  caller workflow. SonarCloud analysis is intentionally skipped on this template
+  repository: as Jinja2 meta-code, the template body is not statically
+  analyzable as Python, and the analysis was failing with a `curl 403` from the
+  SonarCloud quality-gate API. Generated child projects continue to opt into
+  their own SonarCloud analysis via the rendered config that ships inside the
+  template's rendered output directory.
+
 ### Fixed
 
 - `setup_github_protection.py`: hardcoded context names replaced with Jinja2 conditionals

.sonarlint/connectedMode.json

@@ -575,33 +575,11 @@ Templates can execute arbitrary code:
 
 ## SonarCloud Integration
 
-Both the template repository and generated projects support SonarCloud for continuous code quality analysis.
-
-### Template Repository
-
-**Configuration**:
-
-- **Organization**: `williaby`
-- **Project Key**: `ByronWilliamsCPA_cookiecutter-python-template`
-- **Analysis Method**: CI-Based (GitHub Actions)
-- **Workflow**: `.github/workflows/sonarcloud.yml`
-- **Configuration**: `sonar-project.properties`
-- **Dashboard**: <https://sonarcloud.io/project/overview?id=ByronWilliamsCPA_cookiecutter-python-template>
-
-**What's Analyzed**:
-
-- Hook files (`hooks/*.py`)
-- Template files (`{{cookiecutter.project_slug}}/`)
-- Code quality metrics (bugs, code smells, maintainability)
-- Security vulnerabilities and hotspots
-- Hook file test coverage (when tests exist)
-
-**Quality Standards**:
-
-- Quality gate must pass before merging PRs
-- Security rating must be A or B
-- Maintainability rating must be A or B
-- No critical or high-severity vulnerabilities
+Generated projects support SonarCloud for continuous code quality analysis. The template
+repository itself does not run SonarCloud: the Jinja2 template body is not statically
+analyzable as plain Python, and analysis was failing with a `curl 403` from the quality-gate
+API. Neither `sonar-project.properties` nor `.github/workflows/sonarcloud.yml` exist at the
+template repo root.
 
 ### Generated Projects
 

CHANGELOG.md

@@ -90,7 +90,7 @@ git config --global commit.gpgsign true
    cd /tmp && rm -rf my_project
    ```
 6. Open a pull request with a clear description of the change and why it is needed.
-7. Address any feedback from automated reviewers (CodeRabbit, SonarCloud) before
+7. Address any feedback from automated reviewers (CodeRabbit, qlty) before
    requesting human review.
 
 ## Coding Standards

CLAUDE.md

@@ -1,11 +1,6 @@
 # Cookiecutter Python Template
 
 [![Validate Template](https://github.com/ByronWilliamsCPA/cookiecutter-python-template/actions/workflows/validate-template.yml/badge.svg)](https://github.com/ByronWilliamsCPA/cookiecutter-python-template/actions/workflows/validate-template.yml)
-[![SonarCloud](https://github.com/ByronWilliamsCPA/cookiecutter-python-template/actions/workflows/sonarcloud.yml/badge.svg)](https://github.com/ByronWilliamsCPA/cookiecutter-python-template/actions/workflows/sonarcloud.yml)
-[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=ByronWilliamsCPA_cookiecutter-python-template&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=ByronWilliamsCPA_cookiecutter-python-template)
-[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=ByronWilliamsCPA_cookiecutter-python-template&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=ByronWilliamsCPA_cookiecutter-python-template)
-[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=ByronWilliamsCPA_cookiecutter-python-template&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=ByronWilliamsCPA_cookiecutter-python-template)
-[![Code Smells](https://sonarcloud.io/api/project_badges/measure?project=ByronWilliamsCPA_cookiecutter-python-template&metric=code_smells)](https://sonarcloud.io/summary/new_code?id=ByronWilliamsCPA_cookiecutter-python-template)
 
 This folder contains a complete, production-ready cookiecutter template for starting new Python projects.
 
@@ -296,16 +291,11 @@ my_awesome_project/
 
 ## 🔍 SonarCloud Setup (Optional)
 
-Both this template repository and generated projects support SonarCloud for continuous code quality and security analysis.
-
-### For Template Repository (This Repo)
-
-The template repository itself is configured with SonarCloud to analyze hooks and template files:
-
-1. **Project Already Created**: `ByronWilliamsCPA_cookiecutter-python-template`
-2. **Token Configured**: `SONAR_TOKEN` secret added to GitHub organization
-3. **Workflow Enabled**: `.github/workflows/sonarcloud.yml` runs on push/PR
-4. **Dashboard**: [View SonarCloud Dashboard](https://sonarcloud.io/project/overview?id=ByronWilliamsCPA_cookiecutter-python-template)
+Generated projects support SonarCloud for continuous code quality and security analysis.
+This template repository does not run SonarCloud analysis: the Jinja2 template body is not
+statically analyzable as plain Python, and analysis was failing with a `curl 403` from the
+quality-gate API. Generated child projects opt into their own SonarCloud analysis via the
+rendered config that ships inside the template output directory.
 
 ### For Generated Projects
 
@@ -357,7 +347,7 @@ Generated projects include:
 
 ### Analysis Method
 
-Both template and generated projects use **CI-Based Analysis** (not Automatic):
+Generated projects use **CI-Based Analysis** (not Automatic):
 
 - ✅ Full Python language support
 - ✅ Test coverage integration