mirror of https://github.com/Heretek-AI/GDevelop-Heretek.git synced 2026-10-12 02:02:42 +00:00

Files

T

John Smith 48ed4e38d0 chore(maintenance): make fork divergence and static-analysis scope deliberate

Two problems made this fork expensive to maintain: scanner noise nobody
could act on, and divergence from upstream that nothing tracked.

Code scanning reported 3,518 open alerts. 3,449 were fallow findings and
2,399 of those sat in vendored bundles `.fallow.toml` never listed
(jolt-physics.wasm.js 436, box2djs/box2d.js 328, the Firebase SDK 655,
Recast, PeerJS, draco). Listing them plus raising the CRAP thresholds from
the defaults to evidence-based values takes fallow from 3,449 findings to
155, all in maintained code. The remaining 69 were CodeQL: 8 third-party
actions are now pinned to full commit SHAs with `# vN` comments (so
Dependabot keeps updating them) and all 10 workflows declare an explicit
least-privilege `permissions:` block.

SonarCloud's 2,845 open issues are mostly not this fork's code — 2,526 sit
in files byte-identical to upstream. The real defect was configuration:
~200 lines of `sonar.issue.ignore.multicriteria.e1..e88` in
.sonarcloud.properties, plus scripts/sonarcloud-apply-suppressions.sh, were
inert. That key is a Project Settings UI setting and cannot be read from
that file under automatic analysis, so two phases of remediation work
chased config the server never saw. Both are deleted; the exclusions that
do work are kept and extended. `sonar.test.inclusions` no longer declares
production source directories as test inclusions.

Divergence is now bounded and checked. `fork-divergence.json` is a
checked-in allowlist of the 111 modified, 51 fork-only and 7
upstream-missing paths, and `scripts/check-fork-divergence.js` fails CI on
divergence that is not listed or on stale entries. It reads upstream
through the GitHub trees API because 4ian/GDevelop is ~1.7GB and this runs
on every PR. Restoring Extensions/Physics3DBehavior/tests/
Physics3DRuntimeBehavior.spec.js — deleted by an earlier SonarCloud pass to
silence one rule — removes one entry each.

Repairs found along the way: every `// nosonar` marker sat on the line
before the statement SonarCloud flags, where the directive does nothing;
each is now on the exact reported line. Four garbled comment fragments left
in multiplayertools.ts by the same pass are gone. A two-line re-export shim
with no importers (AiGeneration/CustomAIClient.js) is deleted.

`scripts/sonarcloud-drift.js` now writes its outputs to $GITHUB_OUTPUT and
seeds its own baseline, so the weekly drift job's ceiling can actually fire;
it previously ran behind `continue-on-error` against a threshold that
predated the exclusions and was unreachable.

Root documentation collapses to MAINTENANCE.md. The three SonarCloud phase
plans and the Dependabot plan described steps that were proven impossible
and are deleted; AI_GAME_STUDIO_ASSESSMENT.md is a design record and stays.

Verified: newIDE/app 176/176 suites and 1,922 tests pass; GDevelop.js 33/33
suites and 1,177 tests pass; GDJS Karma 1,287 pass with the same 9
pre-existing failures (Firebase network tests) reproduced on a pristine
tree. check-format lists 37 files against the documented 41-file baseline,
so no new violations. Lockfile, drift and divergence guards all exit 0.

2026-09-22 20:01:28 -04:00

1.9 KiB

Raw Blame History

Scripts files for GDevelop

Repository-wide tooling. Per-package scripts live in each package's own package.json, not here.

Fork maintenance

See MAINTENANCE.md for how these fit together.

check-fork-divergence.js: keeps the fork's divergence from upstream 4ian/GDevelop bounded. Compares this tree against upstream and checks the result against the checked-in fork-divergence.json allowlist; exits 1 on a path that diverges without being listed or a listed path that no longer diverges. --update rewrites the allowlist, --list prints the divergence set. Runs in ci.yml (fork-divergence job) and, informationally, in upstream-sync.yml.
sonarcloud-drift.js: compares the project's open SonarCloud issue count against .sonarcloud-drift-baseline and fails when growth exceeds the threshold. Self-seeds the baseline when it is missing and writes count / baseline / seeded to $GITHUB_OUTPUT. --update-baseline records the current count; --max-growth-pct=<n> overrides the 10% default. Runs weekly in .github/workflows/fallow.yml.
security/check-lockfiles.js: asserts no manifest in the repo pins a known-malicious or critically vulnerable version of the packages listed in the script. Runs in ci.yml (lockfile-guard job).

Documentation and translations

GenerateAllDocs.[bat|sh]: Calls doxygen to generate all documentation into docs folder.
ExtractTranslations.[bat|sh]: Creates the source.pot file containing the strings to be translated using Crowdin.

Upstream scripts removed in this fork

ReleaseProcedure.bat, ReleaseProcedure.sh and CopyWindowsToLinuxReleaseFiles.sh are referenced by older upstream docs but do not exist in this checkout — packaging happens through .github/workflows/build-release.yml and newIDE/electron-app. Do not add them back from an upstream sync.

1.9 KiB Raw Blame History

Scripts files for GDevelop

Fork maintenance

Documentation and translations

Upstream scripts removed in this fork

1.9 KiB

Raw Blame History