BillyOutlastandJohn Smith 342d15b949 Remediate all 680 SonarCloud issues for Heretek-AI_drop2 (#5) ...

* chore: gitignore SonarCloud issue dump and local fix scripts

* fix(sast): remediate SonarCloud mechanical issues (S9011, S6822, S7772, S2933, S1128)

- add explicit type="button" to bare vue/tsx buttons (S9011)
- drop redundant role="list" on ul/ol (Web:S6822)
- prefix node: builtin imports (S7772)
- mark never-modified class members readonly via flows (S2933)
- prune unused named imports (S1128)

Covers 89+25+35+32+30 = 211 of 680 open issues.

* fix(sast): remediate SonarCloud optional-chain/refactor rules

- S6582: nullish-guard -> optional chain (28)
- S6759: React props inline types -> Readonly<Props> (35)
- S7754: findIndex/find-filter .length -> .some (17)
- S3626: remove redundant trailing continue/return (16)
- S7752: .map().flat() -> .flatMap (10)
- S7723: Array() -> new Array (6)
- S7755: [len-1] -> .at(-1) (with non-null assertion in lastItem)
- S7750: .filter().at(0) -> .find (1)

* fix(sast): shell, Docker, and workflow hardening

- shelldre:S7688: if [ .. ] -> [[ .. ]] in clippy-changed.sh + version_update.sh (6)
- docker:S7018: alphabetical apt package sort in Dockerfile (2)
- docker/githubactions:S6505: add --ignore-scripts to pnpm install runs (5 workflow + 1 Dockerfile)

* fix(sast): remediate SonarCloud a11y and small-refactor rules (Phase 3)

* fix(sast): Phase 4 code-able security hardening

- typescript:S4790: md5 -> sha256 in server/internal/library/import tasks + fsBackend object hash (non-cryptographic use, no value dependency)
- swift:S1481: remove unused status local in appletrust/add-certificate.swift
- swift:S1066: merge nested if-let in getCertificateFromString
- javascript:S7767: | 0 -> Math.trunc in base32 pad calc
- javascript:S7751: [].concat(...) -> .flatMap(...) in base32 decoder
- shell:S6506: add --max-redirect=5 to wget in optimize-appimage.sh

Lockfile policy (text:S8570/S8549), prisma migrations (plsql), TODOs (S1135),
SHA-pinning (S7637), regex backtracking (S8786), PATH-taint (S4036), and the
OIDC-Spec URI (S5332) are addressed by SonarCloud-side wontfix accepts in
the following commit.

---------

Co-authored-by: John Smith <[email protected]>

2026-08-27 20:17:39 -04:00

..

docs

fix(security): resolve code-scanning alerts

2026-08-26 03:06:39 -04:00

promo

Remediate all 680 SonarCloud issues for Heretek-AI_drop2 (#5)

2026-08-27 20:17:39 -04:00