fix(sonar): skip SonarCloud analysis on template repo#80
Conversation
Remove `.github/workflows/sonarcloud.yml` and root-level
`sonar-project.properties`. As Jinja2 meta-code, this template body is not
statically analyzable as Python, and the analysis was failing with a curl
403 from the SonarCloud quality-gate API (the project key was effectively
unanalyzable: source paths like `{{cookiecutter.project_slug}}/` are literal
text on the template-repo side and only become real directories in the
rendered child project).
Generated child projects continue to opt into their own SonarCloud
analysis via the rendered `sonar-project.properties` and `sonarcloud.yml`
workflow that ship inside the template's rendered output directory; that
analysis is unaffected because it runs after cookiecutter has rendered
the placeholders.
Refs: Phase 3 Bucket E (CI Repair Sprint)
|
Warning Review limit reached
More reviews will be available in 41 minutes and 27 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (9)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR removes SonarCloud analysis from the template repository itself (where Jinja2 placeholder paths prevent meaningful scanning), while keeping SonarCloud support in generated projects via the already-templated SonarCloud workflow/config inside {{cookiecutter.project_slug}}/.
Changes:
- Deleted the root SonarCloud caller workflow and root
sonar-project.propertiesto stop running SonarCloud on the template repo. - Updated the root CI workflow commentary/step summary to reflect that SonarCloud is intentionally not executed for the template repository.
- Documented the removal in the Unreleased changelog.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
sonar-project.properties (deleted) |
Removes root SonarCloud scanner configuration that referenced non-real template paths. |
.github/workflows/sonarcloud.yml (deleted) |
Stops the dedicated SonarCloud workflow from running on the template repository. |
.github/workflows/ci.yml |
Updates inline notes and the final summary output to reflect the new “no SonarCloud in template repo” posture. |
CHANGELOG.md |
Adds an Unreleased “Removed” entry documenting the workflow/config removal and rationale. |
| # Note: SonarCloud analysis is intentionally NOT run on this template repo. | ||
| # As meta-code (Jinja2 placeholders rendered at instantiation time), the | ||
| # template body is not analyzable as plain Python. Generated child projects | ||
| # opt into their own SonarCloud analysis via the rendered config that ships | ||
| # inside the rendered template directory. |
PR Review: fix(sonar): skip SonarCloud analysis on template repoCI: All checks passing. Merge state: CLEAN. Critical (must fix before merge)
Important (should fix)
Suggested
🤖 Generated with Claude Code |
…letion - README.md: drop SonarCloud badges; update setup section to reflect that the template repo is excluded from analysis (Jinja2 placeholders are not statically analyzable as Python) - CLAUDE.md: remove Template Repository subsection from SonarCloud section; retain Generated Projects subsection unchanged - ci.yml: drop SonarQube feature line from header; update Layer 3 description to Ruff/BasedPyright/Bandit to match actual toolchain - CHANGELOG.md: reorder [Unreleased] subsections to Added, Changed, Removed, Fixed per Keep a Changelog 1.1.0 spec (Removed was misplaced before Changed) - CONTRIBUTING.md: replace SonarCloud with qlty in automated reviewers list - .sonarlint/connectedMode.json: delete orphaned IDE config pointing to the now-deleted analysis project (caused SonarLint connection errors) - .secrets.baseline: add SHA-pin entries from .pre-commit-config.yaml that were false-positived as high-entropy secrets
Fix-pass applied -- commit 52aa74fThe following findings from the pr-review pass have been resolved: Critical
Important
Suggested
Informational
Pre-commit baseline update (side-effect)
All changes verified clean: ruff format, ruff check, bandit, and all 25 pre-commit hooks pass. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Summary
Removes the SonarCloud caller workflow and root-level
sonar-project.propertiesfrom this Cookiecutter template repository. SonarCloud analysis here was failing with acurl 403from the quality-gate API and was structurally unfixable: the source paths configured in the properties file ({{cookiecutter.project_slug}}/) are literal Jinja2 placeholders on the template-repo side, not real directories. The template body is meta-code, not application code, and is not statically analyzable as plain Python.Generated child projects continue to opt into their own SonarCloud analysis via the rendered
sonar-project.propertiesandsonarcloud.ymlworkflow that ship inside{{cookiecutter.project_slug}}/. That analysis is unaffected by this change because cookiecutter renders the placeholders at instantiation time, well before any scanner runs on the generated repo.Why option B (skip), not option A (move into template dir)
{{cookiecutter.project_slug}}/sonar-project.properties; the root copy was the duplicate that was failing.Files changed
.github/workflows/sonarcloud.yml(deleted)sonar-project.properties(deleted).github/workflows/ci.yml(comment block and step-summary updated to reflect new state)CHANGELOG.md(Unreleased / Removed entry)Test plan
Refs: Phase 3 Bucket E (CI Repair Sprint)
Generated with Claude Code