fix(sonar): repair quality gate baseline and fix new-code bugs (#103)

Inject sonar.projectVersion from package.json so the new-code baseline resets each release; suppress S2245 (TestDataGenerator sample data) and S2871 (diff-engine internal canonical keys) as documented false positives. Fix real bugs: in-place column-sort mutation in the schema-diff engine, a tautological stroke ternary in SchemaDiagram, and keyboard-accessible saved-chart menu activation. Bumps version to 0.9.36.

Author: cevheri

.github/workflows/ci.yml

@@ -188,10 +188,19 @@ jobs:
           echo "=== Sample record ==="
           head -20 coverage/lcov.info
 
+      # Report the package version so SonarCloud's "previous_version" new-code
+      # definition resets its baseline at each release. Single source of truth:
+      # package.json (node is preinstalled on the runner). Read into a step
+      # output, then passed to the scanner via args (not shell-interpolated).
+      - name: Resolve project version
+        id: pkg
+        run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
+
       - name: SonarCloud Scan
         uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
         with:
           args: >
+            -Dsonar.projectVersion=${{ steps.pkg.outputs.version }}
             -Dsonar.verbose=true
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@libredb/studio",
-  "version": "0.9.35",
+  "version": "0.9.36",
   "private": false,
   "publishConfig": {
     "access": "public"

sonar-project.properties

@@ -2,7 +2,10 @@ sonar.projectKey=libredb_libredb-studio
 sonar.organization=libredb
 
 sonar.projectName=libredb-studio
-sonar.projectVersion=0.6.38
+# sonar.projectVersion is intentionally NOT hardcoded here. CI injects it from
+# package.json (-Dsonar.projectVersion=<version>) so the "previous_version"
+# new-code definition resets its baseline at every release. A hardcoded value
+# freezes the baseline, making months of code count as "new" forever.
 
 sonar.sources=src
 sonar.tests=tests,e2e
@@ -19,3 +22,19 @@ sonar.cpd.exclusions=tests/**,e2e/**
 sonar.javascript.lcov.reportPaths=coverage/lcov.info
 sonar.typescript.tsconfigPath=tsconfig.json
 sonar.sourceEncoding=UTF-8
+
+# S2245 (insecure pseudorandom number generator) is a false positive in
+# TestDataGenerator: Math.random there only produces fake sample rows (names,
+# addresses, lorem ipsum) to populate dev/test tables. No security, crypto, or
+# token use, so a CSPRNG is unwarranted. Suppress the rule for that file only.
+sonar.issue.ignore.multicriteria=e1,e2
+sonar.issue.ignore.multicriteria.e1.ruleKey=typescript:S2245
+sonar.issue.ignore.multicriteria.e1.resourceKey=src/components/TestDataGenerator.tsx
+
+# S2871 wants String.localeCompare when sorting strings. In diff-engine the
+# .sort() calls build internal canonical keys for index-column SETS (used for
+# equality matching), not user-facing ordering. They must be deterministic and
+# locale-independent, so the default code-point sort is correct here and
+# localeCompare would be a bug. Suppress S2871 for this file only.
+sonar.issue.ignore.multicriteria.e2.ruleKey=typescript:S2871
+sonar.issue.ignore.multicriteria.e2.resourceKey=src/lib/schema-diff/diff-engine.ts

src/components/DataCharts.tsx

@@ -772,9 +772,10 @@ export function DataCharts({ result }: DataChartsProps) {
                   {savedCharts.map((chart) => (
                     <DropdownMenuItem
                       key={chart.id}
+                      onSelect={() => loadSavedChart(chart)}
                       className="text-xs cursor-pointer flex items-center justify-between gap-4"
                     >
-                      <span onClick={() => loadSavedChart(chart)}>
+                      <span>
                         {chart.name} <span className="text-zinc-600">({chart.chartType})</span>
                       </span>
                       <button

src/components/PivotTable.tsx

@@ -84,7 +84,7 @@ export function PivotTable({ result, onLoadQuery }: PivotTableProps) {
       colMap.get(colKey)!.push(value);
     }
 
-    const colKeys = colField ? Array.from(colValues).sort() : ["__all__"];
+    const colKeys = colField ? Array.from(colValues).sort((a, b) => a.localeCompare(b)) : ["__all__"];
 
     // Build pivot rows
     const pivotRows: { rowKey: string; values: Map<string, string> }[] = [];

src/components/SchemaDiagram.tsx

@@ -217,7 +217,9 @@ function SchemaDiagramInner({ schema, onClose }: SchemaDiagramProps) {
           labelBgStyle: { fill: "#0d0d0d", fillOpacity: 0.8 },
           labelBgPadding: [4, 2] as [number, number],
           style: {
-            stroke: isHighlighted ? "#3b82f6" : "#3b82f6",
+            // Highlight is conveyed by strokeWidth + opacity below; the stroke
+            // colour is the same blue in both states.
+            stroke: "#3b82f6",
             strokeWidth: isHighlighted ? 2 : 1.5,
             opacity: selectedNode ? (isHighlighted ? 1 : 0.15) : 0.4,
           },

src/lib/schema-diff/diff-engine.ts

@@ -79,16 +79,22 @@ function diffColumns(sourceCols: ColumnSchema[], targetCols: ColumnSchema[]): Co
 function diffIndexes(sourceIndexes: IndexSchema[], targetIndexes: IndexSchema[]): IndexDiff[] {
   const diffs: IndexDiff[] = [];
 
+  // Build a stable map key from the column set. Copy before sorting so the
+  // original column order is preserved for the diff messages below. Use the
+  // default (code-point) sort, NOT localeCompare: this is an internal canonical
+  // key for set matching, so it must be deterministic and locale-independent.
+  // localeCompare would tie the key to the host locale. S2871 is suppressed for
+  // this file in sonar-project.properties for exactly this reason.
+  const columnKey = (idx: IndexSchema) => idx.name || [...idx.columns].sort().join(",");
+
   const sourceMap = new Map<string, IndexSchema>();
   sourceIndexes.forEach((idx) => {
-    const key = idx.name || idx.columns.sort().join(",");
-    sourceMap.set(key, idx);
+    sourceMap.set(columnKey(idx), idx);
   });
 
   const targetMap = new Map<string, IndexSchema>();
   targetIndexes.forEach((idx) => {
-    const key = idx.name || idx.columns.sort().join(",");
-    targetMap.set(key, idx);
+    targetMap.set(columnKey(idx), idx);
   });
 
   for (const [key, idx] of targetMap) {
@@ -120,8 +126,11 @@ function diffIndexes(sourceIndexes: IndexSchema[], targetIndexes: IndexSchema[])
     if (!targetIdx) continue;
 
     const changes: string[] = [];
-    const sourceColStr = sourceIdx.columns.sort().join(",");
-    const targetColStr = targetIdx.columns.sort().join(",");
+    // Code-point sort (not localeCompare) so this equality check is deterministic
+    // and locale-independent — see columnKey above.
+    const sortedJoin = (cols: string[]) => [...cols].sort().join(",");
+    const sourceColStr = sortedJoin(sourceIdx.columns);
+    const targetColStr = sortedJoin(targetIdx.columns);
 
     if (sourceColStr !== targetColStr) {
       changes.push(`Columns changed: (${sourceIdx.columns.join(", ")}) → (${targetIdx.columns.join(", ")})`);