ci(sonar): exclude hypatia wrapper from analysis#40
Merged
Conversation
…nherit) The hypatia-scan.yml wrapper's only SonarCloud finding is the `secrets: inherit` Security Hotspot, which is required by hyperpolymath/standards hypatia-scan-reusable.yml — the reusable consumes HYPATIA_DISPATCH_PAT but does not declare it as a workflow_call secret, so `secrets: inherit` is the only way to pass it through (gitbot-fleet Phase 2). Add sonar-project.properties excluding the thin, SHA-pinned wrapper from analysis (it has no other code to scan). NOTE: this repo uses SonarCloud Automatic Analysis, where UI settings take precedence and file-based exclusions may not clear the Quality Gate; marking the hotspot "Safe" in the SonarCloud UI is the reliable backstop. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AHygjxRyU3WwmXEhA9KF5L
hyperpolymath
marked this pull request as ready for review
June 24, 2026 19:27
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
sonar-project.propertiesexcluding.github/workflows/hypatia-scan.ymlfrom SonarCloud analysis. Follow-up to the merged #35.After #35 (the Hypatia reusable-workflow conversion) merged, its single SonarCloud finding — the
secrets: inheritSecurity Hotspot — now lives onmainand will keep failing the Quality Gate on future PRs. That construct is required:hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.ymlconsumesHYPATIA_DISPATCH_PATbut doesn't declare it as aworkflow_callsecret, sosecrets: inheritis the only way to pass it (for the gitbot-fleet Phase 2 learning submission). It's a reviewed-and-accepted hotspot, not a vulnerability.The wrapper is a thin, SHA-pinned file with no other code to analyse, so excluding it loses no meaningful coverage.
This repo uses SonarCloud Automatic Analysis (GitHub App; no CI scanner step, no prior config file). Under Automatic Analysis, UI-configured settings take precedence and there are documented cases where a repo-file
sonar.exclusionsdoes not clear the Quality Gate. I can't verify the effect from here (the Sonar API is auth-walled).Reliable backstop (server-side, ~1 min): mark the
secrets: inherithotspot "Safe" on the SonarCloud Security Hotspots page, or deactivate the rule in the Quality Profile / drop the "Security Hotspots Reviewed" condition from the Quality Gate. Per our agreement, you're doing this UI action; this PR is the best-effort repo-config half.Type of change
🤖 Generated with Claude Code
https://claude.ai/code/session_01AHygjxRyU3WwmXEhA9KF5L
Generated by Claude Code