55 lines
3.8 KiB
Markdown
55 lines
3.8 KiB
Markdown
# SonarQube triage loop
|
|
|
|
Local script `scripts/sonar_triage.mjs` (`npm run sonar:triage`). Dry-run by default; nothing is pushed, ever.
|
|
|
|
```
|
|
SonarQube /api/issues/search (GET, paged, OPEN/CONFIRMED/REOPENED)
|
|
|
|
|
classify --skip-list--> SKIPPED (reported only)
|
|
|
|
|
+----+-----------------------------+
|
|
SMALL MEDIUM / LARGE
|
|
| (--apply --fix-small) | (--apply)
|
|
task file -> `claude -p` group by (rule, file) -> `gh issue create`
|
|
-> ONE local commit (labels sonar, agent-fix; dedupe marker)
|
|
`fix(sonar): ...` |
|
|
`multica issue create --assignee sonar-fixer`
|
|
-> agent fixes, local commit only
|
|
```
|
|
|
|
## Classification
|
|
- SMALL: severity INFO/MINOR (or MAJOR with effort <= 5 min) AND rule in `scripts/sonar_triage.rules.json` AND file under `core/ routes/ static/js/ scripts/`.
|
|
- Never small: any VULNERABILITY; path or message mentioning auth/crypto/async/thread/lock/SQL/secret/token/password; files elsewhere (incl. tests).
|
|
- LARGE: severity BLOCKER/CRITICAL or effort > 60 min; otherwise MEDIUM.
|
|
- SKIPPED: matches an entry of `scripts/sonar_triage.skip.json` (rule, file regex, message regex; every given field must match). Entries: server.py 0.0.0.0 bind, tmp-dir dev script, Math.random ids, http:// LAN URLs, md5 cache key.
|
|
- Allowlist (each reason is in the JSON): python/javascript S1481 unused local, S1116 empty statement, javascript S1128 unused import, python/javascript S125 commented-out code.
|
|
|
|
## Flags
|
|
`--dry-run` (default) | `--apply` | `--since-new-code` (default) | `--all` | `--json <file>` | `--max-issues N` | `--cap N` (GitHub issues per run, default 10) | `--fix-small` (needs `--apply`) | `--list-rules`.
|
|
|
|
## GitHub issues
|
|
One per (rule, file); title `[sonar] <rule>: <short> in <file>`; body holds Sonar keys, lines, rule link, effort, approach, acceptance. Hidden marker `<!-- sonar-keys: k1,k2 -->`; an open `sonar` issue containing any of the keys suppresses a new one. Bodies contain paths/lines only, no code. If `gh auth status` fails the script reports and continues.
|
|
|
|
## multica hookup
|
|
After a GitHub issue is created the script runs `multica issue create --project <id> --assignee sonar-fixer --description-stdin` (the multica issue links the GitHub URL; assigning starts the agent run). Override with `MULTICA_AGENT`, `MULTICA_PROJECT`. Failure is reported, not fatal. Agent `sonar-fixer` instructions: see the end of this file.
|
|
|
|
## --fix-small
|
|
Refuses on a dirty tracked tree. Writes a task file to a temp dir (not committed), runs `claude -p` with only Read/Edit/Grep/Glob and Bash for check-frontend, `node --test`, git add/commit/status/diff, then verifies the new commit count and clean tree. Local commit only.
|
|
|
|
## Secrets
|
|
The token is read inside the script from `~/.config/sonar-token` (or `SONAR_TOKEN`) and sent as HTTP Basic auth (token as user, empty password). It is never printed, put in argv/URLs or written to files; a unit test asserts it is absent from output.
|
|
|
|
## Run
|
|
```
|
|
npm run sonar:triage # dry-run, new code
|
|
npm run sonar:triage -- --all --json /tmp/t.json
|
|
npm run sonar:triage -- --apply --cap 5 # create GitHub + multica issues
|
|
npm run sonar:triage -- --apply --fix-small
|
|
```
|
|
|
|
## Rollback
|
|
Local fix commits: `git reset --hard <sha before>` / `git revert`. Issues: close the GitHub issue and the multica issue. Nothing is pushed by the script.
|
|
|
|
## sonar-fixer agent instructions
|
|
Fix only the given Sonar issue. Read CLAUDE.md and PROJECT_MAP.md first. Run `node scripts/check-frontend.mjs` and Python `unittest` with an isolated HOME; tests mock the API and import from tests/_guard.js. One local Conventional Commit `fix(sonar): ...`; never push; never touch secrets; if a design decision is needed, stop and comment.
|