sonar-project.properties

sonar.projectKey=libredb_libredb-studio
sonar.organization=libredb

sonar.projectName=libredb-studio
# sonar.projectVersion is intentionally NOT hardcoded here. CI injects it from
# package.json (-Dsonar.projectVersion=<version>) so the "previous_version"
# new-code definition resets its baseline at every release. A hardcoded value
# freezes the baseline, making months of code count as "new" forever.

sonar.sources=src
sonar.tests=tests,e2e
sonar.test.inclusions=tests/**/*.test.ts,tests/**/*.test.tsx,e2e/**/*.spec.ts

# Exclude only runtime/generated code, NOT test files
sonar.exclusions=**/node_modules/**,**/.next/**,**/build/**,**/out/**,src/components/ui/**

# Duplication: test files share intentional mock/setup boilerplate (provider
# mocks, request fixtures). That repetition is expected harness scaffolding, not
# production duplication, so exclude tests from copy-paste detection.
sonar.cpd.exclusions=tests/**,e2e/**

# src/exports/index.js is a one-line CJS shim (module.exports = require("./index.ts"))
# for bundlers that cannot resolve .ts entry points. It has no testable logic; it is
# smoke-tested by tests/isolated/exports-shim.test.ts, which runs WITHOUT coverage
# because importing the shim loads the entire component chain unexercised and would
# pollute the merged lcov with load-only zero-hit records.
sonar.coverage.exclusions=src/exports/index.js

sonar.javascript.lcov.reportPaths=coverage/lcov.info
sonar.typescript.tsconfigPath=tsconfig.json
sonar.sourceEncoding=UTF-8

# S2245 (insecure pseudorandom number generator) is a false positive in
# TestDataGenerator: Math.random there only produces fake sample rows (names,
# addresses, lorem ipsum) to populate dev/test tables. No security, crypto, or
# token use, so a CSPRNG is unwarranted. Suppress the rule for that file only.
sonar.issue.ignore.multicriteria=e1,e2
sonar.issue.ignore.multicriteria.e1.ruleKey=typescript:S2245
sonar.issue.ignore.multicriteria.e1.resourceKey=src/components/TestDataGenerator.tsx

# S2871 wants String.localeCompare when sorting strings. In diff-engine the
# .sort() calls build internal canonical keys for index-column SETS (used for
# equality matching), not user-facing ordering. They must be deterministic and
# locale-independent, so the default code-point sort is correct here and
# localeCompare would be a bug. Suppress S2871 for this file only.
sonar.issue.ignore.multicriteria.e2.ruleKey=typescript:S2871
sonar.issue.ignore.multicriteria.e2.resourceKey=src/lib/schema-diff/diff-engine.ts