sonar-project.properties

# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
# SPDX-License-Identifier: MPL-2.0
# SonarCloud / SonarQube Cloud analysis configuration.
#
# Exclude the Hypatia workflow wrapper from analysis. Its only Sonar
# finding is the `secrets: inherit` Security Hotspot, and that construct
# is REQUIRED by hyperpolymath/standards hypatia-scan-reusable.yml: the
# reusable consumes ${{ secrets.HYPATIA_DISPATCH_PAT }} but does not
# declare it as a workflow_call secret, so `secrets: inherit` is the only
# way to pass it through (needed by the gitbot-fleet Phase 2 learning
# submission). The file is a thin, SHA-pinned wrapper with no other code
# to analyse, so excluding it loses no meaningful coverage.
#
# NOTE: this repo uses SonarCloud Automatic Analysis, where settings
# configured in the SonarCloud UI take precedence over this file and
# file-based exclusions do not always clear the Quality Gate. If the gate
# still reports the hotspot after this lands, mark it "Safe" on the
# SonarCloud Security Hotspots page (or deactivate the rule in the Quality
# Profile) as the reliable backstop.
sonar.exclusions=.github/workflows/hypatia-scan.yml