Heretek-AI/GDevelop-Heretek
1
0
Fork 0
mirror of https://github.com/Heretek-AI/GDevelop-Heretek.git synced 2026-10-11 21:09:52 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
GDevelop-Heretek/.fallow.toml
T
John Smith 48ed4e38d0 chore(maintenance): make fork divergence and static-analysis scope deliberate 
Two problems made this fork expensive to maintain: scanner noise nobody
could act on, and divergence from upstream that nothing tracked.

Code scanning reported 3,518 open alerts. 3,449 were fallow findings and
2,399 of those sat in vendored bundles `.fallow.toml` never listed
(jolt-physics.wasm.js 436, box2djs/box2d.js 328, the Firebase SDK 655,
Recast, PeerJS, draco). Listing them plus raising the CRAP thresholds from
the defaults to evidence-based values takes fallow from 3,449 findings to
155, all in maintained code. The remaining 69 were CodeQL: 8 third-party
actions are now pinned to full commit SHAs with `# vN` comments (so
Dependabot keeps updating them) and all 10 workflows declare an explicit
least-privilege `permissions:` block.

SonarCloud's 2,845 open issues are mostly not this fork's code — 2,526 sit
in files byte-identical to upstream. The real defect was configuration:
~200 lines of `sonar.issue.ignore.multicriteria.e1..e88` in
.sonarcloud.properties, plus scripts/sonarcloud-apply-suppressions.sh, were
inert. That key is a Project Settings UI setting and cannot be read from
that file under automatic analysis, so two phases of remediation work
chased config the server never saw. Both are deleted; the exclusions that
do work are kept and extended. `sonar.test.inclusions` no longer declares
production source directories as test inclusions.

Divergence is now bounded and checked. `fork-divergence.json` is a
checked-in allowlist of the 111 modified, 51 fork-only and 7
upstream-missing paths, and `scripts/check-fork-divergence.js` fails CI on
divergence that is not listed or on stale entries. It reads upstream
through the GitHub trees API because 4ian/GDevelop is ~1.7GB and this runs
on every PR. Restoring Extensions/Physics3DBehavior/tests/
Physics3DRuntimeBehavior.spec.js — deleted by an earlier SonarCloud pass to
silence one rule — removes one entry each.

Repairs found along the way: every `// nosonar` marker sat on the line
before the statement SonarCloud flags, where the directive does nothing;
each is now on the exact reported line. Four garbled comment fragments left
in multiplayertools.ts by the same pass are gone. A two-line re-export shim
with no importers (AiGeneration/CustomAIClient.js) is deleted.

`scripts/sonarcloud-drift.js` now writes its outputs to $GITHUB_OUTPUT and
seeds its own baseline, so the weekly drift job's ceiling can actually fire;
it previously ran behind `continue-on-error` against a threshold that
predated the exclusions and was unreachable.

Root documentation collapses to MAINTENANCE.md. The three SonarCloud phase
plans and the Dependabot plan described steps that were proven impossible
and are deleted; AI_GAME_STUDIO_ASSESSMENT.md is a design record and stays.

Verified: newIDE/app 176/176 suites and 1,922 tests pass; GDevelop.js 33/33
suites and 1,177 tests pass; GDJS Karma 1,287 pass with the same 9
pre-existing failures (Firebase network tests) reproduced on a pristine
tree. check-format lists 37 files against the documented 41-file baseline,
so no new violations. Lockfile, drift and divergence guards all exit 0.
2026-09-22 20:01:28 -04:00

131 lines
5.5 KiB
TOML
Raw Permalink Blame History

# Fallow configuration for the monorepo.
#
# Excludes paths we don't maintain (vendored bundles, codemod output,
# generated test fixtures) so they don't pollute the static analysis
# results. These mirror the .sonarcloud.properties exclusions.
#
# ignorePatterns is honoured: a path listed here produces zero findings.
# Verified 2026-09-22 against the live code-scanning alert set — every
# path already listed reported exactly 0 alerts, while the vendored
# bundles added below accounted for 2,399 of the 3,449 fallow alerts.
#
# Per-rule/per-pattern suppression isn't a fallow config feature (it
# uses inline `// fallow-ignore-next-line <kind>` markers instead).
ignorePatterns = [
# Vendored / bundled JS (Emscripten, spine-pixi, monaco, three, pixi,
# howler, rbush, nanomarkdown, etc.)
"Extensions/Spine/spine-pixi-v7/**",
"GDJS/Runtime/libs/**",
"GDJS/Runtime/pixi-renderers/pixi.js",
"GDJS/Runtime/pixi-renderers/three.js",
"GDJS/Runtime/pixi-renderers/ThreeAddons.js",
"GDJS/Runtime/howler-sound-manager/howler.min.js",
"GDJS/Runtime/fontfaceobserver-font-manager/fontfaceobserver.js",
# Three.js examples (vendored from three/addons)
"SharedLibs/ThreeAddons/**",
# Pixi filter bundles (vendored)
"Extensions/Effects/pixi-filters/filter-color-gradient.js",
"Extensions/Effects/pixi-filters/filter-glitch.js",
# Bundled Firebase JS
"Extensions/Firebase/B_firebasetools/**",
# Generated extension shells (codemod output, not maintained)
"Extensions/Physics3DBehavior/JsExtension.js",
"Extensions/TileMap/JsExtension.js",
"Extensions/NavMeshPathfinding/JsExtension.js",
# Generated Emscripten bindings
"GDevelop.js/Bindings/Wrapper.cpp",
"GDevelop.js/Bindings/postjs.js",
"GDevelop.js/Bindings/glue.cpp",
"GDevelop.js/Bindings/glue.js",
# Vendored editor assets shipped with newIDE/app
"newIDE/app/public/external/**",
# Generated codemod output and test fixtures
"newIDE/app/src/EditorFunctions/index.js",
"newIDE/app/src/EditorFunctions/SimplifiedProject/**",
"newIDE/app/src/stories/**",
"newIDE/app/resources/GDJS/Runtime-sources/**",
# Flow type definitions
"**/flow-typed/**",
"**/flow-libs/**",
# Build artifacts
"build/**",
"dist/**",
"node_modules/**",
"Binaries/**",
# Karma tests in GDJS (browser-based, not part of Jest)
"GDJS/tests/games/**",
# Generated localization files
"newIDE/app/src/locales/**",
# ---------------------------------------------------------------------
# Vendored third-party bundles not previously listed. These are the files
# .gitattributes already marks `linguist-vendored`, plus the Emscripten /
# Firebase / Recast / Jolt / pixi-filters build outputs shipped verbatim.
# Every one is byte-identical to its upstream copy; none is hand-edited.
# ---------------------------------------------------------------------
# Physics engine builds (box2d, Box2D wasm, Jolt wasm)
"Extensions/Physics3DBehavior/*.wasm.js",
"Extensions/Physics3DBehavior/jolt-physics.wasm.js",
"Extensions/Physics2Behavior/Box2D_v2.3.1_min.wasm.js",
"Extensions/Physics2Behavior/box2d.js",
"Extensions/PhysicsBehavior/Box2D/**",
"Extensions/PhysicsBehavior/box2djs/**",
# Firebase SDK bundles (A_ = base, B_ = per-product build)
"Extensions/Firebase/A_firebasejs/**",
# Recast/Detour navmesh wasm build
"Extensions/NavMeshPathfinding/recast-navigation-generators.js",
"Extensions/NavMeshPathfinding/recast-navigation.wasm.js",
# PeerJS bundles
"Extensions/P2P/A_peer.js",
"Extensions/Multiplayer/peer.js",
# Other vendored minified bundles
"Extensions/BBText/pixi-multistyle-text/**",
"Extensions/DialogueTree/bondage.js/**",
"Extensions/ParticleSystem/SPARK/**",
"Extensions/ParticleSystem/pixi-particles-pixi-renderer.min.js",
"Extensions/PrimitiveDrawing/pixi-graphics-extras/**",
"Extensions/Shopify/shopify-buy.umd.polyfilled.min.js",
"Extensions/SpatialSound/howler.spatial.min.js",
"Extensions/TileMap/helper/TileMapHelper.js",
"Extensions/TileMap/pako/**",
"Extensions/TileMap/pixi-tilemap/**",
# Draco decoder wrapper shipped with the pixi renderer
"GDJS/Runtime/pixi-renderers/draco/**",
# Vendored pixi-filters builds (the whole directory is a vendored copy)
"Extensions/Effects/pixi-filters/**",
# Vendored SHA implementations (third-party, kept verbatim)
"Extensions/Leaderboards/sha256.js",
"newIDE/app/src/Utils/Sha256.js",
"newIDE/app/src/Utils/Crypto/sha512.js",
# Generated TypeScript declarations for the C++ core
"GDevelop.js/types/**",
"GDevelop.js/types.d.ts",
]
# Complexity / CRAP thresholds.
#
# The defaults (maxCrap 30, maxCyclomatic 20, maxCognitive 15) were written
# for a small greenfield project. Measured on this tree on 2026-09-22, the
# default maxCrap of 30 reported 926 functions in non-vendored code — a
# number nobody can act on, dominated by code this fork does not own (89% of
# open findings sit in files byte-identical to upstream).
#
# Raised to values that keep only genuine outliers:
# maxCrap 200 -> 149 findings remain (from 926)
# maxCyclomatic 25 -> cyclomatic 25+ only
# maxCognitive 25 -> drops the cognitive-15..24 band
# maxUnitSize 200 -> generous; test `describe()` blocks are exempted below
#
# Re-derive these from `fallow health` output rather than copying them if the
# tree changes materially.
[health]
maxCrap = 200
maxCyclomatic = 25
maxCognitive = 25
maxUnitSize = 200
# Inline markers used in source for per-line/per-file suppression:
# // fallow-ignore-next-line <kind>
# // fallow-ignore-file <kind>
Reference in New Issue View Git Blame Copy Permalink