mirror of
https://github.com/Heretek-AI/GDevelop-Heretek.git
synced 2026-10-11 21:09:52 +00:00
John Smith
48ed4e38d0
Two problems made this fork expensive to maintain: scanner noise nobody could act on, and divergence from upstream that nothing tracked. Code scanning reported 3,518 open alerts. 3,449 were fallow findings and 2,399 of those sat in vendored bundles `.fallow.toml` never listed (jolt-physics.wasm.js 436, box2djs/box2d.js 328, the Firebase SDK 655, Recast, PeerJS, draco). Listing them plus raising the CRAP thresholds from the defaults to evidence-based values takes fallow from 3,449 findings to 155, all in maintained code. The remaining 69 were CodeQL: 8 third-party actions are now pinned to full commit SHAs with `# vN` comments (so Dependabot keeps updating them) and all 10 workflows declare an explicit least-privilege `permissions:` block. SonarCloud's 2,845 open issues are mostly not this fork's code — 2,526 sit in files byte-identical to upstream. The real defect was configuration: ~200 lines of `sonar.issue.ignore.multicriteria.e1..e88` in .sonarcloud.properties, plus scripts/sonarcloud-apply-suppressions.sh, were inert. That key is a Project Settings UI setting and cannot be read from that file under automatic analysis, so two phases of remediation work chased config the server never saw. Both are deleted; the exclusions that do work are kept and extended. `sonar.test.inclusions` no longer declares production source directories as test inclusions. Divergence is now bounded and checked. `fork-divergence.json` is a checked-in allowlist of the 111 modified, 51 fork-only and 7 upstream-missing paths, and `scripts/check-fork-divergence.js` fails CI on divergence that is not listed or on stale entries. It reads upstream through the GitHub trees API because 4ian/GDevelop is ~1.7GB and this runs on every PR. Restoring Extensions/Physics3DBehavior/tests/ Physics3DRuntimeBehavior.spec.js — deleted by an earlier SonarCloud pass to silence one rule — removes one entry each. Repairs found along the way: every `// nosonar` marker sat on the line before the statement SonarCloud flags, where the directive does nothing; each is now on the exact reported line. Four garbled comment fragments left in multiplayertools.ts by the same pass are gone. A two-line re-export shim with no importers (AiGeneration/CustomAIClient.js) is deleted. `scripts/sonarcloud-drift.js` now writes its outputs to $GITHUB_OUTPUT and seeds its own baseline, so the weekly drift job's ceiling can actually fire; it previously ran behind `continue-on-error` against a threshold that predated the exclusions and was unreachable. Root documentation collapses to MAINTENANCE.md. The three SonarCloud phase plans and the Dependabot plan described steps that were proven impossible and are deleted; AI_GAME_STUDIO_ASSESSMENT.md is a design record and stays. Verified: newIDE/app 176/176 suites and 1,922 tests pass; GDevelop.js 33/33 suites and 1,177 tests pass; GDJS Karma 1,287 pass with the same 9 pre-existing failures (Firebase network tests) reproduced on a pristine tree. check-format lists 37 files against the documented 41-file baseline, so no new violations. Lockfile, drift and divergence guards all exit 0.
117 lines
4.4 KiB
Properties
117 lines
4.4 KiB
Properties
# SonarCloud configuration for the Heretek-AI/GDevelop-Heretek fork.
|
|
#
|
|
# !!! READ THIS BEFORE ADDING RULE-LEVEL SUPPRESSIONS !!!
|
|
#
|
|
# This project uses SonarCloud *automatic analysis* (verified: the project
|
|
# setting `sonar.autoscan.enabled` is `true`). Under automatic analysis:
|
|
#
|
|
# * Only the keys documented for `.sonarcloud.properties` are honoured —
|
|
# `sonar.sources`, `sonar.exclusions`, `sonar.inclusions`, `sonar.tests`,
|
|
# `sonar.test.exclusions`, `sonar.test.inclusions`, `sonar.sourceEncoding`,
|
|
# `sonar.cpd.exclusions`, `sonar.python.version`.
|
|
# * `sonar.issue.ignore.multicriteria` (and its `sonar.issue.enforce.*`
|
|
# sibling) are NOT among them and CANNOT be set from this file. They are
|
|
# a Project Settings -> Issues -> Exclusions (UI) setting only.
|
|
#
|
|
# A previous revision of this file carried ~200 lines of commented-out
|
|
# `sonar.issue.ignore.multicriteria.e1..e88` entries. They were inert and
|
|
# were deleted; the same applies to `scripts/sonarcloud-apply-suppressions.sh`,
|
|
# which only printed them. Do not re-add either. If rule-level suppression is
|
|
# wanted later, that is a UI action or a switch to CI-based analysis.
|
|
#
|
|
# Path exclusions below ARE honoured — verified against the live issue set:
|
|
# a path listed here reports zero open issues while a sibling path outside
|
|
# the list reports them (e.g. filter-glitch.js = 0, filter-crt.js = 5).
|
|
#
|
|
# These mirror the .fallow.toml exclusions.
|
|
|
|
sonar.exclusions=\
|
|
Extensions/Spine/spine-pixi-v7/**,\
|
|
GDJS/Runtime/libs/**,\
|
|
GDJS/Runtime/pixi-renderers/pixi.js,\
|
|
GDJS/Runtime/pixi-renderers/three.js,\
|
|
GDJS/Runtime/pixi-renderers/ThreeAddons.js,\
|
|
GDJS/Runtime/pixi-renderers/draco/**,\
|
|
GDJS/Runtime/howler-sound-manager/howler.min.js,\
|
|
GDJS/Runtime/fontfaceobserver-font-manager/fontfaceobserver.js,\
|
|
newIDE/app/public/external/**,\
|
|
newIDE/app/src/EditorFunctions/index.js,\
|
|
newIDE/app/src/EditorFunctions/SimplifiedProject/**,\
|
|
newIDE/app/src/stories/**,\
|
|
newIDE/app/resources/GDJS/Runtime-sources/**,\
|
|
**/flow-typed/**,\
|
|
**/flow-libs/**,\
|
|
build/**,\
|
|
dist/**,\
|
|
node_modules/**,\
|
|
Binaries/**,\
|
|
GDJS/tests/games/**,\
|
|
newIDE/app/src/locales/**,\
|
|
SharedLibs/ThreeAddons/**,\
|
|
Extensions/Physics3DBehavior/JsExtension.js,\
|
|
Extensions/Effects/pixi-filters/**,\
|
|
Extensions/Firebase/B_firebasetools/**,\
|
|
Extensions/TileMap/JsExtension.js,\
|
|
Extensions/NavMeshPathfinding/JsExtension.js,\
|
|
GDevelop.js/Bindings/Wrapper.cpp,\
|
|
GDevelop.js/Bindings/postjs.js,\
|
|
GDevelop.js/Bindings/glue.cpp,\
|
|
GDevelop.js/Bindings/glue.js,\
|
|
GDevelop.js/types/**,\
|
|
GDevelop.js/types.d.ts
|
|
|
|
# Scope of the files analyzed as production source.
|
|
#
|
|
# `newIDE/app/src` (the editor UI, ~2,350 source files) is deliberately NOT
|
|
# listed as a test root and is not excluded either. It is currently absent
|
|
# from the SonarCloud index entirely — see MAINTENANCE.md for the measured
|
|
# state and the probe command. Do not "fix" that by adding it to
|
|
# `sonar.exclusions`: that would hide the fork's own AI/Studio code from
|
|
# analysis permanently, which is worse than the current gap.
|
|
sonar.sources=\
|
|
newIDE/app/src,\
|
|
newIDE/app/scripts,\
|
|
Extensions,\
|
|
GDJS/Runtime,\
|
|
GDevelop.js,\
|
|
SharedLibs
|
|
|
|
# Test scope.
|
|
#
|
|
# This block previously read `sonar.test.inclusions=newIDE/app/src/**,
|
|
# Extensions/**/*.{js,ts}, ...` under the comment "Test coverage paths (only
|
|
# include JS source we actively maintain)" — i.e. it declared *production*
|
|
# source directories as test inclusions. That is a misreading of the key:
|
|
# `sonar.test.inclusions` is a glob filter applied *within* `sonar.tests`, and
|
|
# `Extensions/**/*.{js,ts}` is not a valid Sonar glob (no brace expansion).
|
|
#
|
|
# Corrected form: `sonar.tests` names the roots that contain test files, and
|
|
# `sonar.test.inclusions` keeps only the actual test files in scope.
|
|
sonar.tests=\
|
|
Extensions,\
|
|
GDevelop.js,\
|
|
GDJS/tests,\
|
|
SharedLibs,\
|
|
newIDE/app/scripts
|
|
|
|
sonar.test.inclusions=\
|
|
**/*.spec.js,\
|
|
**/*.spec.ts,\
|
|
**/*.spec.tsx,\
|
|
**/__tests__/**,\
|
|
**/tests/**
|
|
|
|
# C++/Python/etc. are handled by separate tooling
|
|
sonar.c.file.suffixes=-
|
|
sonar.cpp.file.suffixes=-
|
|
sonar.python.file.suffixes=-
|
|
sonar.java.file.suffixes=-
|
|
|
|
# Coverage exclusions (block the coverage tool from looking at
|
|
# generated/transpiled files where coverage is meaningless)
|
|
sonar.coverage.exclusions=\
|
|
**/*.spec.js,\
|
|
**/*.spec.ts,\
|
|
**/stories/**,\
|
|
newIDE/app/src/AiGeneration/AiRequestChat/ChatMessages.js
|