mirror of
https://github.com/Heretek-AI/GDevelop-Heretek.git
synced 2026-10-11 21:09:52 +00:00
John Smith
48ed4e38d0
Two problems made this fork expensive to maintain: scanner noise nobody could act on, and divergence from upstream that nothing tracked. Code scanning reported 3,518 open alerts. 3,449 were fallow findings and 2,399 of those sat in vendored bundles `.fallow.toml` never listed (jolt-physics.wasm.js 436, box2djs/box2d.js 328, the Firebase SDK 655, Recast, PeerJS, draco). Listing them plus raising the CRAP thresholds from the defaults to evidence-based values takes fallow from 3,449 findings to 155, all in maintained code. The remaining 69 were CodeQL: 8 third-party actions are now pinned to full commit SHAs with `# vN` comments (so Dependabot keeps updating them) and all 10 workflows declare an explicit least-privilege `permissions:` block. SonarCloud's 2,845 open issues are mostly not this fork's code — 2,526 sit in files byte-identical to upstream. The real defect was configuration: ~200 lines of `sonar.issue.ignore.multicriteria.e1..e88` in .sonarcloud.properties, plus scripts/sonarcloud-apply-suppressions.sh, were inert. That key is a Project Settings UI setting and cannot be read from that file under automatic analysis, so two phases of remediation work chased config the server never saw. Both are deleted; the exclusions that do work are kept and extended. `sonar.test.inclusions` no longer declares production source directories as test inclusions. Divergence is now bounded and checked. `fork-divergence.json` is a checked-in allowlist of the 111 modified, 51 fork-only and 7 upstream-missing paths, and `scripts/check-fork-divergence.js` fails CI on divergence that is not listed or on stale entries. It reads upstream through the GitHub trees API because 4ian/GDevelop is ~1.7GB and this runs on every PR. Restoring Extensions/Physics3DBehavior/tests/ Physics3DRuntimeBehavior.spec.js — deleted by an earlier SonarCloud pass to silence one rule — removes one entry each. Repairs found along the way: every `// nosonar` marker sat on the line before the statement SonarCloud flags, where the directive does nothing; each is now on the exact reported line. Four garbled comment fragments left in multiplayertools.ts by the same pass are gone. A two-line re-export shim with no importers (AiGeneration/CustomAIClient.js) is deleted. `scripts/sonarcloud-drift.js` now writes its outputs to $GITHUB_OUTPUT and seeds its own baseline, so the weekly drift job's ceiling can actually fire; it previously ran behind `continue-on-error` against a threshold that predated the exclusions and was unreachable. Root documentation collapses to MAINTENANCE.md. The three SonarCloud phase plans and the Dependabot plan described steps that were proven impossible and are deleted; AI_GAME_STUDIO_ASSESSMENT.md is a design record and stays. Verified: newIDE/app 176/176 suites and 1,922 tests pass; GDevelop.js 33/33 suites and 1,177 tests pass; GDJS Karma 1,287 pass with the same 9 pre-existing failures (Firebase network tests) reproduced on a pristine tree. check-format lists 37 files against the documented 41-file baseline, so no new violations. Lockfile, drift and divergence guards all exit 0.
6 lines
107 B
Plaintext
6 lines
107 B
Plaintext
{
|
|
"count": 2845,
|
|
"recordedAt": "2026-09-22T23:44:25.919Z",
|
|
"source": "scripts/sonarcloud-drift.js"
|
|
}
|