mARTin-B78/tts-voice-creator-clone-and-design-2

mARTin-B78 98a87077d9 feat(qa): sonar triage loop (dry-run default) and multica agent hookup

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-10-06 02:47:21 +02:00

3.8 KiB

Raw Blame History

SonarQube triage loop

Local script scripts/sonar_triage.mjs (npm run sonar:triage). Dry-run by default; nothing is pushed, ever.

SonarQube /api/issues/search (GET, paged, OPEN/CONFIRMED/REOPENED)
        |
   classify  --skip-list--> SKIPPED (reported only)
        |
   +----+-----------------------------+
 SMALL                         MEDIUM / LARGE
   |  (--apply --fix-small)          |  (--apply)
 task file -> `claude -p`      group by (rule, file) -> `gh issue create`
 -> ONE local commit           (labels sonar, agent-fix; dedupe marker)
 `fix(sonar): ...`                   |
                               `multica issue create --assignee sonar-fixer`
                               -> agent fixes, local commit only

Classification

SMALL: severity INFO/MINOR (or MAJOR with effort <= 5 min) AND rule in scripts/sonar_triage.rules.json AND file under core/ routes/ static/js/ scripts/.
Never small: any VULNERABILITY; path or message mentioning auth/crypto/async/thread/lock/SQL/secret/token/password; files elsewhere (incl. tests).
LARGE: severity BLOCKER/CRITICAL or effort > 60 min; otherwise MEDIUM.
SKIPPED: matches an entry of scripts/sonar_triage.skip.json (rule, file regex, message regex; every given field must match). Entries: server.py 0.0.0.0 bind, tmp-dir dev script, Math.random ids, http:// LAN URLs, md5 cache key.
Allowlist (each reason is in the JSON): python/javascript S1481 unused local, S1116 empty statement, javascript S1128 unused import, python/javascript S125 commented-out code.

Flags

GitHub issues

One per (rule, file); title [sonar] <rule>: <short> in <file>; body holds Sonar keys, lines, rule link, effort, approach, acceptance. Hidden marker ; an open sonar issue containing any of the keys suppresses a new one. Bodies contain paths/lines only, no code. If gh auth status fails the script reports and continues.

multica hookup

After a GitHub issue is created the script runs multica issue create --project <id> --assignee sonar-fixer --description-stdin (the multica issue links the GitHub URL; assigning starts the agent run). Override with MULTICA_AGENT, MULTICA_PROJECT. Failure is reported, not fatal. Agent sonar-fixer instructions: see the end of this file.

--fix-small

Refuses on a dirty tracked tree. Writes a task file to a temp dir (not committed), runs claude -p with only Read/Edit/Grep/Glob and Bash for check-frontend, node --test, git add/commit/status/diff, then verifies the new commit count and clean tree. Local commit only.

Secrets

The token is read inside the script from ~/.config/sonar-token (or SONAR_TOKEN) and sent as HTTP Basic auth (token as user, empty password). It is never printed, put in argv/URLs or written to files; a unit test asserts it is absent from output.

Run

npm run sonar:triage                        # dry-run, new code
npm run sonar:triage -- --all --json /tmp/t.json
npm run sonar:triage -- --apply --cap 5     # create GitHub + multica issues
npm run sonar:triage -- --apply --fix-small

Rollback

Local fix commits: git reset --hard <sha before> / git revert. Issues: close the GitHub issue and the multica issue. Nothing is pushed by the script.

sonar-fixer agent instructions

Fix only the given Sonar issue. Read CLAUDE.md and PROJECT_MAP.md first. Run node scripts/check-frontend.mjs and Python unittest with an isolated HOME; tests mock the API and import from tests/_guard.js. One local Conventional Commit fix(sonar): ...; never push; never touch secrets; if a design decision is needed, stop and comment.

3.8 KiB Raw Blame History