sonar-project.properties

# SonarQube Cloud analysis for jpipe-vscode.
#
# Identity and scope only. The quality-gate wait lives in .github/workflows/sonar.yml, next to
# the thing whose exit code it changes.
#
# See jpipe-vscode ADR-VSC-0009 (the gate) and ADR-VSC-0010 (coverage and its exclusions).

sonar.projectKey=jpipe-mcscert_jpipe-vscode
sonar.organization=jpipe-mcscert
sonar.projectName=jPipe VS Code Extension

sonar.sourceEncoding=UTF-8

# Two workspaces plus the extension's bundler script. Nothing at the repository root is source.
# Naming the source roots explicitly, rather than setting `sonar.sources=.` and excluding the
# rest, keeps this file short and keeps `out/`, `node_modules/` and `syntaxes/` out of scope
# without a single exclusion line — they are simply not under any path listed here.
sonar.sources=packages/language/src,packages/extension/src,packages/extension/esbuild.mjs
sonar.tests=packages/language/test,packages/extension/test

# langium-cli writes these from src/jpipe.langium. They are git-ignored, regenerated by
# `npm run langium:generate` in every CI job, and must never be hand-edited — so every issue
# raised against them is unactionable, and their ~1,850 lines would dominate every metric on
# the language package. See jpipe-vscode ADR-VSC-0006.
#
# The webview's tsconfig.json is excluded because it sits *inside* `src/` — it has to, since
# that is the only place editors look for it (jpipe-vscode ADR-VSC-0003) — so the scanner would
# otherwise index it as a JSON source file and warn `Cannot parse ...tsconfig.json:13:1` on its
# comments. TypeScript allows comments in tsconfig; a strict JSON parser does not. The scanner
# still reads it correctly as a TypeScript project; only the JSON sensor is confused by it.
sonar.exclusions=packages/language/src/generated/**,packages/extension/src/webview/tsconfig.json

# Fixtures are data — real compiler output and hand-built reports — not test code.
sonar.test.exclusions=packages/extension/test/fixtures/**

# ------------------------------------------------------------ suppressed findings
#
# Every entry below names exactly one rule and one file, and carries its own justification
# immediately above it. None of them is a category exemption: a rule that is not listed is
# raised normally, in these files as in any other. Two are accepted debt — the finding is true
# and we are choosing to live with it — and one is a false positive, which is a different claim
# and is labelled as such.
#
# All three are here rather than in the SonarCloud UI so the reason is reviewed with the code
# and survives the project being recreated. The shared cost: a suppressed finding disappears
# from the dashboard entirely, so anyone reading SonarCloud alone will not know these were ever
# examined. The ADRs cited below are the counterweight.
sonar.issue.ignore.multicriteria=globPortComplexity,launcherEscapeRegexes,hoverHelperAssertions

# typescript:S3776 (cognitive complexity) in jpipe-glob.ts only — ACCEPTED DEBT.
#
# The file is a hand-written port of OpenJDK's `sun.nio.fs.Globs.toUnixRegexPattern`, and its
# obligation is to agree with the jPipe compiler's `LoadResolver.java` — not to be a good glob
# library (jpipe-vscode ADR-VSC-0007). The two functions this silences, `globToRegExp` (27) and
# `parseCharacterClass` (30), score what they score because the shape of the algorithm is the
# shape of the port. Restructuring them for the metric would trade the single property they must
# have, in the one module where divergence is hardest to notice: the symptom is a model resolving
# different files in the editor than in the build.
#
# Complexity elsewhere is not covered by this argument, and no other rule firing on this file is
# covered either — including the two `String.raw` suggestions (typescript:S7780), which remain
# open. Revisit if the port is ever replaced by a dependency, at which point ADR-VSC-0007 is
# superseded anyway.
sonar.issue.ignore.multicriteria.globPortComplexity.ruleKey=typescript:S3776
sonar.issue.ignore.multicriteria.globPortComplexity.resourceKey=packages/language/src/jpipe-glob.ts

# typescript:S8786 (superlinear regex backtracking) in process-launcher.ts only — ACCEPTED DEBT.
#
# Its two escaping regexes are a verbatim port of `cross-spawn`'s `cmd.exe` rules, which decide
# whether an argument reaches the compiler intact or is re-parsed by a command interpreter
# (jpipe-vscode ADR-VSC-0018). The backtracking the rule objects to is real; the input is a path
# from the user's own settings, so the worst case is someone hanging their own editor. A
# "simplification" that changes the backslash arithmetic reintroduces command injection, on
# Windows only, where none of us develop.
#
# typescript:S7780 on the same line is deliberately NOT covered: that one is about how a
# replacement *string* is spelled, and String.raw there produces an identical result. This
# argument is about behaviour that must not change, and does not stretch to spelling.
sonar.issue.ignore.multicriteria.launcherEscapeRegexes.ruleKey=typescript:S8786
sonar.issue.ignore.multicriteria.launcherEscapeRegexes.resourceKey=packages/extension/src/extension/process-launcher.ts

# typescript:S2699 (test without an assertion) in hovering.test.ts only — FALSE POSITIVE.
#
# Not accepted debt: those tests do assert. They call Langium's own `expectHover` helper, passing
# the expected text as the `hover:` field, and the helper — named `expect*` — does the asserting.
# Sonar cannot see through it. Nothing is fixable here without abandoning a vendor helper to
# satisfy an analyser.
#
# Marking the seven issues False Positive in the SonarCloud UI would say this more precisely and
# would not blanket the rule for the file. It is done here instead for the reason given at the
# top — at the extra cost, specific to this entry, that a genuinely assertion-free test added to
# this file later would go unflagged. Every test in it uses `expectHover` by construction, which
# is what makes that acceptable.
sonar.issue.ignore.multicriteria.hoverHelperAssertions.ruleKey=typescript:S2699
sonar.issue.ignore.multicriteria.hoverHelperAssertions.resourceKey=packages/language/test/hovering.test.ts

# Produced by `npm run test:coverage`, which the workflow runs immediately before the scan.
sonar.javascript.lcov.reportPaths=packages/language/coverage/lcov.info,packages/extension/coverage/lcov.info

# Not coverable, by construction rather than by neglect: each of these either imports `vscode`,
# which does not exist outside an extension host, or is a browser/process entry point with
# module-level side effects. There is no VS Code host and no browser in the test environment,
# so none of them can be loaded at all — see jpipe-vscode ADR-VSC-0004.
#
# Counting them would make the gate's coverage-on-new-code condition unsatisfiable for any
# change to the extension host, which would end with the condition being lowered instead. The
# rule for this list is *uncoverable by construction, never merely untested*.
#
# The `packages/extension/src/**` entries below must stay in step with `coverage.exclude` in
# packages/extension/vitest.config.ts — nothing enforces that, so change both together. The
# last two entries have no counterpart there and need none: `packages/language/src/index.ts`
# is eighteen `export *` lines and reports LF:0, and `esbuild.mjs` is a build script that no
# test runs and that Vitest never sees, since its coverage scope is `src/` only.
sonar.coverage.exclusions=\
  packages/extension/src/extension/main.ts,\
  packages/extension/src/extension/logger.ts,\
  packages/extension/src/extension/exclusions.ts,\
  packages/extension/src/extension/commands.ts,\
  packages/extension/src/extension/exclusion-commands.ts,\
  packages/extension/src/extension/compiler/managed-install.ts,\
  packages/extension/src/extension/compiler/jar-selection.ts,\
  packages/extension/src/extension/compiler/image-generator.ts,\
  packages/extension/src/extension/preview/preview-provider.ts,\
  packages/extension/src/extension/compiler/release-manager.ts,\
  packages/extension/src/extension/preview/preview-shell.ts,\
  packages/extension/src/language/main.ts,\
  packages/extension/src/webview/preview.ts,\
  packages/extension/src/webview/minimap.ts,\
  packages/extension/src/shared/preview-protocol.ts,\
  packages/language/src/index.ts,\
  packages/extension/esbuild.mjs