diff --git a/sonar-project.properties b/sonar-project.properties new file mode 100644 index 0000000..728a7ee --- /dev/null +++ b/sonar-project.properties @@ -0,0 +1,20 @@ +# // Copyright (c) Jonathan D.A. Jewell +# SPDX-License-Identifier: MPL-2.0 +# SonarCloud / SonarQube Cloud analysis configuration. +# +# Exclude the Hypatia workflow wrapper from analysis. Its only Sonar +# finding is the `secrets: inherit` Security Hotspot, and that construct +# is REQUIRED by hyperpolymath/standards hypatia-scan-reusable.yml: the +# reusable consumes ${{ secrets.HYPATIA_DISPATCH_PAT }} but does not +# declare it as a workflow_call secret, so `secrets: inherit` is the only +# way to pass it through (needed by the gitbot-fleet Phase 2 learning +# submission). The file is a thin, SHA-pinned wrapper with no other code +# to analyse, so excluding it loses no meaningful coverage. +# +# NOTE: this repo uses SonarCloud Automatic Analysis, where settings +# configured in the SonarCloud UI take precedence over this file and +# file-based exclusions do not always clear the Quality Gate. If the gate +# still reports the hotspot after this lands, mark it "Safe" on the +# SonarCloud Security Hotspots page (or deactivate the rule in the Quality +# Profile) as the reliable backstop. +sonar.exclusions=.github/workflows/hypatia-scan.yml