sonar-project.properties

sonar.projectKey=Open-MBEE_OpenSysML
sonar.organization=openmbee

# Go sources and tests share directories, so the split is by pattern, not path.
# The clients keep theirs apart, so each language's test root is named too, as
# are the repository scripts' tests (scripts/*-test.py); without them a test
# file is measured as product code.
sonar.sources=.
sonar.tests=.
sonar.test.inclusions=**/*_test.go,scripts/*-test.py,client/python/tests/**,client/java/*/src/test/**,client/node/test/**,client/rust/opensysml/tests/**,editors/*/*/src/test/**,editors/**/*.test.ts,editors/**/*.test.tsx

# Fixtures, demos, the fetched OMG corpus, and generated code are not
# hand-written source; scripts/ and .github/ stay in scope on purpose. The
# clients' protobuf and Connect stubs are generated by buf and guarded by a
# drift check in CI, so they belong here with **/*.pb.go rather than in a
# quality profile no one can act on. The header partial is a verbatim copy of the
# theme's own, kept in step by scripts/mkdocs_header_menu.py, so it is not ours to
# edit either. The editors' API stubs mirror vendor signatures for compiling only
# and cannot change without diverging from the vendor API.
sonar.exclusions=overrides/partials/header.html,**/*_test.go,**/testdata/**,examples/**,client/python/tests/**,**/*.pb.go,internal/translate/rdf/ontology/table.go,client/node/src/generated/**,client/python/opensysml/proto/**,client/java/opensysml-client/src/main/java/org/openmbee/opensysml/proto/**,client/java/opensysml-client/src/main/java/org/openmbee/opensysml/internal/Protos.java,client/rust/opensysml/src/proto/**,editors/cameo/openapi-stubs/**,editors/syson/syson-api-stubs/**
sonar.test.exclusions=**/testdata/**,examples/**,client/python/tests/golden/**

# Each language's test job writes its report and persists it to the workspace,
# and the scan job requires those jobs; a language whose report is missing has
# every line counted as uncovered.
sonar.go.coverage.reportPaths=coverage.txt
# coverage-python.xml is the client's test run; coverage-scripts.xml is the
# repository scripts (scripts/*.py, client/python/scripts/*.py) run the way
# the checks run them and by their tests (make scripts-coverage).
sonar.python.coverage.reportPaths=coverage-python.xml,coverage-scripts.xml
sonar.javascript.lcov.reportPaths=coverage-node.lcov
sonar.typescript.lcov.reportPaths=coverage-node.lcov
# ~60 TS files don't need the default 2.2 GB Node heap, and its budget is
# shared with the analysis JVM inside the scan container.
sonar.javascript.node.maxspace=1024
sonar.coverage.jacoco.xmlReportPaths=client/java/opensysml-client/target/site/jacoco/jacoco.xml,client/java/opensysml-conformance/target/site/jacoco/jacoco.xml

# The Java sensor resolves types from compiled classes, not from sources: with
# these absent it warns and degrades to a syntactic analysis. java-test builds
# them and copies the dependency jars beside them, then persists all four.
sonar.java.binaries=client/java/opensysml-client/target/classes,client/java/opensysml-conformance/target/classes
sonar.java.test.binaries=client/java/opensysml-client/target/test-classes,client/java/opensysml-conformance/target/test-classes
sonar.java.libraries=client/java/opensysml-client/target/dependency/*.jar,client/java/opensysml-conformance/target/dependency/*.jar
sonar.java.test.libraries=client/java/opensysml-client/target/dependency/*.jar,client/java/opensysml-conformance/target/dependency/*.jar

# Unset, the Python sensor assumes every Python 3 version and drops the rules
# that depend on one. The range is the client's own: pyproject requires >=3.10
# and classifies through 3.13.
sonar.python.version=3.10, 3.11, 3.12, 3.13

# Excluded from coverage only; every rule still applies. Each group is tooling no
# test suite executes, never code that ships to users:
# - scripts/pilot-*, scripts/syside-validator: standalone drivers launched as
#   programs against a downloaded OMG toolchain;
# - scripts/mkdocs_landing.py, mkdocs_header_menu.py, mkdocs_repo_links.py: hooks
#   mkdocs calls while building the site; scripts/buf-plugin-python.py: the buf
#   plugin the Python stub generation runs;
# - client/python/scripts/bench_*.py, measure_private_service.py: benchmarks run
#   by hand; make_signed_release_fixture.py: records the committed signing fixtures;
# - editors/vscode: the extension host glue (extension, document, stdlib, diagram)
#   and the webview script only run inside VS Code; check-nodes.mjs, the grammar
#   generator's main and esbuild.mjs are its build steps. The pure webview/nodes.ts
#   and protocol.ts stay measured.
sonar.coverage.exclusions=scripts/pilot-evaluator/**,scripts/pilot-kerml-validator/**,scripts/pilot-sysml-validator/**,scripts/syside-validator/**,scripts/mkdocs_landing.py,scripts/mkdocs_header_menu.py,scripts/mkdocs_repo_links.py,scripts/buf-plugin-python.py,client/python/scripts/bench_latency.py,client/python/scripts/bench_transports.py,client/python/scripts/measure_private_service.py,client/python/scripts/make_signed_release_fixture.py,editors/vscode/src/extension.ts,editors/vscode/src/document.ts,editors/vscode/src/stdlib.ts,editors/vscode/src/diagram.ts,editors/vscode/src/webview/diagram.ts,editors/vscode/tools/check-nodes.mjs,editors/vscode/tools/gengrammar/main.go,editors/vscode/esbuild.mjs

# Each entry below is a rule whose subject in that one file is the documented
# behaviour of a developer command, not a defect; the rule still reports
# everywhere else. Profiling flags are the REPL's feature. The conformance
# harnesses and the example runner build the working tree with the developer's
# own toolchain, and the PSSM referee asks the developer's git for the develop
# commit a checkout is based on. The CLIs read and write the paths named on their
# command line. values.py compares against the exact 1.0 the service sent. The Python client
# states version ranges because pinning them would pin its consumers. A
# table-driven test's branching is its case list, so its cognitive complexity
# measures the table. The sealed sum types are one-method interfaces whose
# method is the marker closing the type, not a verb the -er convention names.
# The AST codec and the planners' errors switch exhaustively over a closed set
# (every node type, every error kind), so their branch count is the set's size.
sonar.issue.ignore.multicriteria=profiling,goToolchainGo,goToolchainReferee,goToolchainNode,goToolchainExamples,cliPathsNode,cliPathsGenerate,cliPathsScripts,exactUnitDefaults,libraryVersions,tableDrivenTests,pinnedDigests,standaloneDrivers,exceptionDepth,restoredDiagnostics,mutationHooks,sealedValue,sealedEdit,sealedCell,sealedExpr,sealedStatement,sealedPass,sealedIR,closedSetCodec,closedSetDocplan,closedSetQueryplan,xmiNamespace,umlNamespace,typingJitter,toolRunnerContext
sonar.issue.ignore.multicriteria.profiling.ruleKey=go:S4507
sonar.issue.ignore.multicriteria.profiling.resourceKey=cmd/sysml/profile.go
sonar.issue.ignore.multicriteria.goToolchainGo.ruleKey=go:S4036
sonar.issue.ignore.multicriteria.goToolchainGo.resourceKey=tools/cmd/conformance/service.go
sonar.issue.ignore.multicriteria.goToolchainReferee.ruleKey=go:S4036
sonar.issue.ignore.multicriteria.goToolchainReferee.resourceKey=tools/cmd/pssm-referee/main.go
sonar.issue.ignore.multicriteria.goToolchainNode.ruleKey=typescript:S4036
sonar.issue.ignore.multicriteria.goToolchainNode.resourceKey=client/node/conformance/main.ts
sonar.issue.ignore.multicriteria.goToolchainExamples.ruleKey=javascript:S4036
sonar.issue.ignore.multicriteria.goToolchainExamples.resourceKey=client/node/scripts/run-example.mjs
sonar.issue.ignore.multicriteria.cliPathsNode.ruleKey=tssecurity:S8707
sonar.issue.ignore.multicriteria.cliPathsNode.resourceKey=client/node/conformance/main.ts
sonar.issue.ignore.multicriteria.cliPathsGenerate.ruleKey=pythonsecurity:S8707
sonar.issue.ignore.multicriteria.cliPathsGenerate.resourceKey=client/python/opensysml/generate.py
sonar.issue.ignore.multicriteria.cliPathsScripts.ruleKey=pythonsecurity:S8707
sonar.issue.ignore.multicriteria.cliPathsScripts.resourceKey=client/python/scripts/*.py
sonar.issue.ignore.multicriteria.exactUnitDefaults.ruleKey=python:S1244
sonar.issue.ignore.multicriteria.exactUnitDefaults.resourceKey=client/python/opensysml/values.py
sonar.issue.ignore.multicriteria.libraryVersions.ruleKey=text:S8565
sonar.issue.ignore.multicriteria.libraryVersions.resourceKey=client/python/pyproject.toml
sonar.issue.ignore.multicriteria.tableDrivenTests.ruleKey=go:S3776
sonar.issue.ignore.multicriteria.tableDrivenTests.resourceKey=**/*_test.go

# The rest are rules whose subject is a deliberate design the rule cannot see. The
# pinned digest table is written by pin_release_checksums.py, so its repeated asset
# names are data. The pilot drivers are single-file programs run as `java File.java`,
# which a package declaration would break. The client's exceptions form one hierarchy on
# top of the JDK's four levels, so a caller catches by how much a failure proved: an
# unsigned release is an unpinned one, which is a checksum the download did not meet.
# ModelException restores its diagnostics in readObject, so the field cannot be final. Mutations' hooks are overridden per
# enum constant, so the base bodies ignore what an override uses. The six Go
# interfaces are sealed-sum markers whose one method is unexported and does nothing,
# so an -er name would say less than the type does. The XMI and UML namespace
# constants are the identifiers the OMG specifications assign, matched against
# the test suite's XMI text and never fetched, so they are http:// as the specifications
# spell them. The landing page's typing animation jitters its delay with
# Math.random; nothing depends on the jitter being unpredictable. The plan's tool
# runner holds the plan's context because the runtime's ToolRunner interface it
# implements is called from executors that carry none.
sonar.issue.ignore.multicriteria.pinnedDigests.ruleKey=python:S1192
sonar.issue.ignore.multicriteria.pinnedDigests.resourceKey=client/python/opensysml/binary.py
sonar.issue.ignore.multicriteria.standaloneDrivers.ruleKey=java:S1598
sonar.issue.ignore.multicriteria.standaloneDrivers.resourceKey=scripts/pilot-*/*.java
sonar.issue.ignore.multicriteria.exceptionDepth.ruleKey=java:S110
sonar.issue.ignore.multicriteria.exceptionDepth.resourceKey=client/java/opensysml-client/src/main/java/org/openmbee/opensysml/*Exception.java
sonar.issue.ignore.multicriteria.restoredDiagnostics.ruleKey=java:S1165
sonar.issue.ignore.multicriteria.restoredDiagnostics.resourceKey=client/java/opensysml-client/src/main/java/org/openmbee/opensysml/*Exception.java
sonar.issue.ignore.multicriteria.mutationHooks.ruleKey=java:S1172
sonar.issue.ignore.multicriteria.mutationHooks.resourceKey=client/java/opensysml-conformance/src/main/java/org/openmbee/opensysml/conformance/Mutations.java
sonar.issue.ignore.multicriteria.sealedValue.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedValue.resourceKey=client/opensysml/value.go
sonar.issue.ignore.multicriteria.sealedEdit.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedEdit.resourceKey=client/opensysml/authoring.go
sonar.issue.ignore.multicriteria.sealedCell.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedCell.resourceKey=client/opensysml/documents.go
sonar.issue.ignore.multicriteria.sealedExpr.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedExpr.resourceKey=tools/census/grammar/xtext.go
sonar.issue.ignore.multicriteria.sealedStatement.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedStatement.resourceKey=internal/ir/lower/action_graph.go
sonar.issue.ignore.multicriteria.sealedPass.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedPass.resourceKey=internal/check/passes/registry.go
sonar.issue.ignore.multicriteria.sealedIR.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedIR.resourceKey=internal/translate/codegen/ir.go
sonar.issue.ignore.multicriteria.closedSetCodec.ruleKey=go:S1479
sonar.issue.ignore.multicriteria.closedSetCodec.resourceKey=internal/syntax/ast/astcodec/nodes.go
sonar.issue.ignore.multicriteria.closedSetDocplan.ruleKey=go:S1479
sonar.issue.ignore.multicriteria.closedSetDocplan.resourceKey=internal/ir/docplan/errors.go
sonar.issue.ignore.multicriteria.closedSetQueryplan.ruleKey=go:S1479
sonar.issue.ignore.multicriteria.closedSetQueryplan.resourceKey=internal/ir/queryplan/errors.go
sonar.issue.ignore.multicriteria.xmiNamespace.ruleKey=go:S5332
sonar.issue.ignore.multicriteria.xmiNamespace.resourceKey=tools/referee/pssm/xmi.go
sonar.issue.ignore.multicriteria.umlNamespace.ruleKey=go:S5332
sonar.issue.ignore.multicriteria.umlNamespace.resourceKey=tools/referee/pssm/reader.go
sonar.issue.ignore.multicriteria.typingJitter.ruleKey=javascript:S2245
sonar.issue.ignore.multicriteria.typingJitter.resourceKey=overrides/home.html
sonar.issue.ignore.multicriteria.toolRunnerContext.ruleKey=godre:S8242
sonar.issue.ignore.multicriteria.toolRunnerContext.resourceKey=internal/exec/analysis/tool_runner.go