sonar-project.properties

sonar.projectKey=Open-MBEE_OpenSysML
sonar.organization=openmbee

# Go sources and tests share directories, so the split is by pattern, not path.
# The clients keep theirs apart, so each language's test root is named too, as
# are the repository scripts' tests (scripts/*-test.py); without them a test
# file is measured as product code.
sonar.sources=.
sonar.tests=.
sonar.test.inclusions=**/*_test.go,scripts/*-test.py,client/python/tests/**,client/jupyter-kernel/tests/**,client/java/*/src/test/**,client/node/test/**,client/rust/opensysml/tests/**,editors/*/*/src/test/**,editors/**/*.test.ts,editors/**/*.test.tsx

# Fixtures, demos, the fetched OMG corpus, and generated code are not
# hand-written source; scripts/ and .github/ stay in scope on purpose. The
# clients' committed protobuf and Connect stubs are generated by buf and guarded
# by a drift check in CI (the Java client's are generated under target/ at build
# time), so they belong here with **/*.pb.go and the Go **/*.connect.go rather than in a
# quality profile no one can act on, as do the Python metamodel classes
# tools/gen/pymetamodel writes and `make python-metamodel-check` guards. The editors' API stubs mirror vendor signatures for
# compiling only and cannot change without diverging from the vendor API.
sonar.exclusions=**/*_test.go,**/testdata/**,examples/**,client/python/tests/**,client/jupyter-kernel/tests/**,**/*.pb.go,**/*.connect.go,internal/translate/rdf/ontology/table.go,client/node/src/generated/**,client/python/opensysml/proto/**,client/python/opensysml/metamodel/_generated.py,client/java/opensysml-client/src/main/java/org/openmbee/opensysml/internal/Protos.java,client/rust/opensysml/src/proto/**,editors/mdk/openapi-stubs/**,editors/syson/syson-api-stubs/**
sonar.test.exclusions=**/testdata/**,examples/**,client/python/tests/golden/**

# Each language's test job writes its report and persists it to the workspace,
# and the scan job requires those jobs; a language whose report is missing has
# every line counted as uncovered.
sonar.go.coverage.reportPaths=coverage.txt
# coverage-python.xml is the client's test run; coverage-scripts.xml is the
# repository scripts (scripts/*.py, client/python/scripts/*.py) run the way
# the checks run them and by their tests (make scripts-coverage).
sonar.python.coverage.reportPaths=coverage-python.xml,coverage-scripts.xml
sonar.javascript.lcov.reportPaths=coverage-node.lcov,coverage-vscode.lcov,coverage-jupyterlab.lcov,coverage-mcp-npm.lcov
sonar.typescript.lcov.reportPaths=coverage-node.lcov,coverage-vscode.lcov,coverage-jupyterlab.lcov,coverage-mcp-npm.lcov
# ~60 TS files don't need the default 2.2 GB Node heap, and its budget is
# shared with the analysis JVM inside the scan container.
sonar.javascript.node.maxspace=1024
sonar.coverage.jacoco.xmlReportPaths=client/java/opensysml-client/target/site/jacoco/jacoco.xml,client/java/opensysml-conformance/target/site/jacoco/jacoco.xml,editors/syson/backend/target/site/jacoco/jacoco.xml,editors/mdk/tools/target/site/jacoco/jacoco.xml,editors/mdk/plugin/target/site/jacoco/jacoco.xml,editors/mdk/mdk-bridge/target/site/jacoco/jacoco.xml

# The Java sensor resolves types from compiled classes, not from sources: with
# these absent it warns and degrades to a syntactic analysis. java-test builds
# them and copies the dependency jars beside them, then persists all four.
sonar.java.binaries=client/java/opensysml-client/target/classes,client/java/opensysml-conformance/target/classes
sonar.java.test.binaries=client/java/opensysml-client/target/test-classes,client/java/opensysml-conformance/target/test-classes
sonar.java.libraries=client/java/opensysml-client/target/dependency/*.jar,client/java/opensysml-conformance/target/dependency/*.jar
sonar.java.test.libraries=client/java/opensysml-client/target/dependency/*.jar,client/java/opensysml-conformance/target/dependency/*.jar

# Unset, the Python sensor assumes every Python 3 version and drops the rules
# that depend on one. The range is the client's own: pyproject requires >=3.10
# and classifies through 3.13.
sonar.python.version=3.10, 3.11, 3.12, 3.13

# Excluded from coverage only; every rule still applies. Each group is code no
# coverage report can measure: tooling no test suite executes, or a language
# the scan receives no coverage for:
# - scripts/pilot-*, scripts/syside-validator: standalone drivers launched as
#   programs against a downloaded OMG toolchain;
# - scripts/mkdocs_landing.py, mkdocs_repo_links.py: hooks
#   mkdocs calls while building the site; scripts/buf-plugin-python.py: the buf
#   plugin the Python stub generation runs;
# - client/python/scripts/bench_*.py, measure_private_service.py: benchmarks run
#   by hand; make_signed_release_fixture.py: records the committed signing fixtures;
# - editors/vscode: the extension host glue (extension, document, stdlib, diagram)
#   and the webview script only run inside VS Code; check-nodes.mjs, the grammar
#   generator's main and esbuild.mjs are its build steps. The pure webview/nodes.ts
#   and protocol.ts stay measured;
# - install.ps1, scripts/install-test.ps1: the Windows installer (which ships)
#   and its fixture, which runs it under pwsh in CI; no PowerShell coverage
#   report is produced, so the analyzer would count every line uncovered;
# - scripts/pilot-json-exporter: the pilot API JSON exporter, a plain-Java
#   program compiled against the pinned pilot jar and run inside its JVM by the
#   differential (scripts/download-pilot-json-exporter.sh), like the drivers above;
# - tools/referee/flexo/stack.go: the Flexo interop gate's stack wrappers, each
#   one request to a running Flexo MMS stack the gate opts into (FLEXO_INTEROP);
#   the client they forward to is tested in internal/translate/interop/flexo;
# - packaging/homebrew/Formula/opensysml.rb: the Homebrew formula template,
#   rendered into the tap at release; brew test runs the installed binary and
#   writes no Ruby coverage, so every line would count uncovered.
sonar.coverage.exclusions=scripts/pilot-evaluator/**,scripts/pilot-kerml-validator/**,scripts/pilot-sysml-validator/**,scripts/syside-validator/**,scripts/mkdocs_landing.py,scripts/mkdocs_repo_links.py,scripts/buf-plugin-python.py,client/python/scripts/bench_latency.py,client/python/scripts/bench_transports.py,client/python/scripts/measure_private_service.py,client/python/scripts/make_signed_release_fixture.py,editors/vscode/src/extension.ts,editors/vscode/src/document.ts,editors/vscode/src/stdlib.ts,editors/vscode/src/diagram.ts,editors/vscode/src/webview/diagram.ts,editors/vscode/tools/check-nodes.mjs,editors/vscode/tools/gengrammar/main.go,editors/vscode/esbuild.mjs,install.ps1,scripts/install-test.ps1,scripts/pilot-json-exporter/**,tools/referee/flexo/stack.go,packaging/homebrew/Formula/opensysml.rb

# Each entry below is a rule whose subject in that one file is the documented
# behaviour of a developer command, not a defect; the rule still reports
# everywhere else. Profiling flags are the REPL's feature. The conformance
# harnesses and the example runner build the working tree with the developer's
# own toolchain, and the PSSM referee asks the developer's git for the develop
# commit a checkout is based on, and the build-info reader asks it what a built binary
# embeds. The CLIs read and write the paths named on their command line, and the
# Jupyter kernel launcher passes Jupyter's arguments on to the kernel binary once
# kernel_arguments has checked each against its flag. values.py compares against the exact 1.0
# the service sent, and Rational.isBinary64 asks whether a rational is exactly the nearest
# double, which only the BigDecimal(double) constructor's binary expansion answers. The
# Python packages state version ranges because pinning them would pin their consumers. A
# table-driven test's branching is its case list, so its cognitive complexity
# measures the table. The sealed sum types are one-method interfaces whose
# method is the marker closing the type, not a verb the -er convention names.
# The AST codec and the planners' errors switch exhaustively over a closed set
# (every node type, every error kind), so their branch count is the set's size.
# The npm alias is pushed by a statement of its own because tests/hygiene pins that
# line as the proof the alias is generated beside the runner's packages.
# release-sbom.py is the release job's own command: the syft and go it runs, the
# assets, lockfile, installer inputs and Z3 zip it reads and the directory it writes
# are the paths and tools the job names on the command line, and what it writes is
# syft's document checked against the asset; there is no other party to validate against.
sonar.issue.ignore.multicriteria=profiling,goToolchainGo,goToolchainReferee,goToolchainBuildInfo,goToolchainNode,goToolchainExamples,cliPathsNode,cliPathsGenerate,cliPathsScripts,cliPathsRelease,kernelArguments,kernelPermissions,keywordAuthoring,exactUnitDefaults,exactBinary64,libraryVersions,tableDrivenTests,pinnedDigests,standaloneDrivers,exceptionDepth,restoredDiagnostics,mutationHooks,sealedValue,sealedEdit,sealedCell,sealedExpr,sealedStatement,sealedPass,sealedIR,closedSetCodec,closedSetDocplan,closedSetQueryplan,xmiNamespace,umlNamespace,typingJitter,runSeed,toolRunnerContext,profileNamespace,keywordChecking,wireRecord,mcpAssetName,animationSteps,candidateTags,npmAliasPush,sbomTools,sbomOutput,sbomPaths,sbomDocument,convertKeywords
sonar.issue.ignore.multicriteria.profiling.ruleKey=go:S4507
sonar.issue.ignore.multicriteria.profiling.resourceKey=cmd/sysml/pprof.go
sonar.issue.ignore.multicriteria.goToolchainGo.ruleKey=go:S4036
sonar.issue.ignore.multicriteria.goToolchainGo.resourceKey=tools/cmd/conformance/service.go
sonar.issue.ignore.multicriteria.goToolchainReferee.ruleKey=go:S4036
sonar.issue.ignore.multicriteria.goToolchainReferee.resourceKey=tools/cmd/pssm-referee/main.go
sonar.issue.ignore.multicriteria.goToolchainBuildInfo.ruleKey=go:S4036
sonar.issue.ignore.multicriteria.goToolchainBuildInfo.resourceKey=tests/testutil/gobuild/buildinfo.go
sonar.issue.ignore.multicriteria.goToolchainNode.ruleKey=typescript:S4036
sonar.issue.ignore.multicriteria.goToolchainNode.resourceKey=client/node/conformance/main.ts
sonar.issue.ignore.multicriteria.goToolchainExamples.ruleKey=javascript:S4036
sonar.issue.ignore.multicriteria.goToolchainExamples.resourceKey=client/node/scripts/run-example.mjs
sonar.issue.ignore.multicriteria.cliPathsNode.ruleKey=tssecurity:S8707
sonar.issue.ignore.multicriteria.cliPathsNode.resourceKey=client/node/conformance/main.ts
sonar.issue.ignore.multicriteria.cliPathsGenerate.ruleKey=pythonsecurity:S8707
sonar.issue.ignore.multicriteria.cliPathsGenerate.resourceKey=client/python/opensysml/generate.py
sonar.issue.ignore.multicriteria.cliPathsScripts.ruleKey=pythonsecurity:S8707
sonar.issue.ignore.multicriteria.cliPathsScripts.resourceKey=client/python/scripts/*.py
sonar.issue.ignore.multicriteria.cliPathsRelease.ruleKey=pythonsecurity:S8707
sonar.issue.ignore.multicriteria.cliPathsRelease.resourceKey=scripts/release-provenance.py
sonar.issue.ignore.multicriteria.sbomTools.ruleKey=pythonsecurity:S8701
sonar.issue.ignore.multicriteria.sbomTools.resourceKey=scripts/release-sbom.py
sonar.issue.ignore.multicriteria.sbomOutput.ruleKey=pythonsecurity:S8705
sonar.issue.ignore.multicriteria.sbomOutput.resourceKey=scripts/release-sbom.py
sonar.issue.ignore.multicriteria.sbomPaths.ruleKey=pythonsecurity:S8707
sonar.issue.ignore.multicriteria.sbomPaths.resourceKey=scripts/release-sbom.py
sonar.issue.ignore.multicriteria.sbomDocument.ruleKey=pythonsecurity:S2083
sonar.issue.ignore.multicriteria.sbomDocument.resourceKey=scripts/release-sbom.py
sonar.issue.ignore.multicriteria.kernelArguments.ruleKey=pythonsecurity:S8705
sonar.issue.ignore.multicriteria.kernelArguments.resourceKey=client/jupyter-kernel/jupyter_opensysml_kernel/__main__.py
sonar.issue.ignore.multicriteria.exactUnitDefaults.ruleKey=python:S1244
sonar.issue.ignore.multicriteria.exactUnitDefaults.resourceKey=client/python/opensysml/values.py
sonar.issue.ignore.multicriteria.exactBinary64.ruleKey=java:S2111
sonar.issue.ignore.multicriteria.exactBinary64.resourceKey=client/java/opensysml-client/src/main/java/org/openmbee/opensysml/Rational.java
sonar.issue.ignore.multicriteria.libraryVersions.ruleKey=text:S8565
sonar.issue.ignore.multicriteria.libraryVersions.resourceKey=client/*/pyproject.toml
sonar.issue.ignore.multicriteria.tableDrivenTests.ruleKey=go:S3776
sonar.issue.ignore.multicriteria.tableDrivenTests.resourceKey=**/*_test.go

# The rest are rules whose subject is a deliberate design the rule cannot see. The
# pinned digest table is written by pin_release_checksums.py, so its repeated asset
# names are data, and the Homebrew formula's repeated "sysml-mcp" is the release asset's
# name, which tests/hygiene pins literally. The pilot drivers are single-file programs run as `java File.java`,
# which a package declaration would break. The client's exceptions form one hierarchy on
# top of the JDK's four levels, so a caller catches by how much a failure proved: an
# unsigned release is an unpinned one, which is a checksum the download did not meet.
# ModelException restores its diagnostics in readObject, so the field cannot be final. Mutations' hooks are overridden per
# enum constant, so the base bodies ignore what an override uses. The six Go
# interfaces are sealed-sum markers whose one method is unexported and does nothing,
# so an -er name would say less than the type does. The XMI and UML namespace
# constants, and the MagicDraw and MDK profile namespaces the migrator reads, are
# the identifiers the specifications and tools assign, matched against XMI text
# and never fetched, so they are http:// as their owners spell them. The landing page's typing animation jitters its delay with
# Math.random, and the editor's landing page draws a run's seed with it, shown and
# replayable; nothing depends on either being unpredictable. The editor's landing
# page awaits each animation step in turn because they are shown one after another. A system-wide kernelspec
# is read and run by every user, so the kernel binary is 0755 and kernel.json 0644, as a
# package manager installs them. The plan's tool
# runner holds the plan's context because the runtime's ToolRunner interface it
# implements is called from executors that carry none. The Python editor's
# add_member takes one keyword per notation clause, which is its public interface, as
# check_action and run_runs take one keyword per request field of the service, and
# ConfigurationComparison one argument per field of the wire message it records.
# The module-level convert takes Connection.convert's keywords plus the service's
# host and port.
# The built-against release tags are a sequence of candidates, one or two depending
# on the version form, not a record.
sonar.issue.ignore.multicriteria.pinnedDigests.ruleKey=python:S1192
sonar.issue.ignore.multicriteria.pinnedDigests.resourceKey=client/python/opensysml/binary.py
sonar.issue.ignore.multicriteria.mcpAssetName.ruleKey=rubydre:S1192
sonar.issue.ignore.multicriteria.mcpAssetName.resourceKey=packaging/homebrew/Formula/opensysml.rb
sonar.issue.ignore.multicriteria.npmAliasPush.ruleKey=javascript:S7778
sonar.issue.ignore.multicriteria.npmAliasPush.resourceKey=client/node/scripts/build-platform-packages.mjs
sonar.issue.ignore.multicriteria.standaloneDrivers.ruleKey=java:S1598
sonar.issue.ignore.multicriteria.standaloneDrivers.resourceKey=scripts/pilot-*/*.java
sonar.issue.ignore.multicriteria.exceptionDepth.ruleKey=java:S110
sonar.issue.ignore.multicriteria.exceptionDepth.resourceKey=client/java/opensysml-client/src/main/java/org/openmbee/opensysml/*Exception.java
sonar.issue.ignore.multicriteria.restoredDiagnostics.ruleKey=java:S1165
sonar.issue.ignore.multicriteria.restoredDiagnostics.resourceKey=client/java/opensysml-client/src/main/java/org/openmbee/opensysml/*Exception.java
sonar.issue.ignore.multicriteria.mutationHooks.ruleKey=java:S1172
sonar.issue.ignore.multicriteria.mutationHooks.resourceKey=client/java/opensysml-conformance/src/main/java/org/openmbee/opensysml/conformance/Mutations.java
sonar.issue.ignore.multicriteria.sealedValue.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedValue.resourceKey=client/opensysml/value.go
sonar.issue.ignore.multicriteria.sealedEdit.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedEdit.resourceKey=client/opensysml/authoring.go
sonar.issue.ignore.multicriteria.sealedCell.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedCell.resourceKey=client/opensysml/documents.go
sonar.issue.ignore.multicriteria.sealedExpr.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedExpr.resourceKey=tools/census/grammar/xtext.go
sonar.issue.ignore.multicriteria.sealedStatement.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedStatement.resourceKey=internal/ir/lower/action_graph.go
sonar.issue.ignore.multicriteria.sealedPass.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedPass.resourceKey=internal/check/passes/registry.go
sonar.issue.ignore.multicriteria.sealedIR.ruleKey=godre:S8196
sonar.issue.ignore.multicriteria.sealedIR.resourceKey=internal/translate/codegen/ir.go
sonar.issue.ignore.multicriteria.closedSetCodec.ruleKey=go:S1479
sonar.issue.ignore.multicriteria.closedSetCodec.resourceKey=internal/syntax/ast/astcodec/nodes.go
sonar.issue.ignore.multicriteria.closedSetDocplan.ruleKey=go:S1479
sonar.issue.ignore.multicriteria.closedSetDocplan.resourceKey=internal/ir/docplan/errors.go
sonar.issue.ignore.multicriteria.closedSetQueryplan.ruleKey=go:S1479
sonar.issue.ignore.multicriteria.closedSetQueryplan.resourceKey=internal/ir/queryplan/errors.go
sonar.issue.ignore.multicriteria.xmiNamespace.ruleKey=go:S5332
sonar.issue.ignore.multicriteria.xmiNamespace.resourceKey=tools/referee/pssm/xmi.go
sonar.issue.ignore.multicriteria.umlNamespace.ruleKey=go:S5332
sonar.issue.ignore.multicriteria.umlNamespace.resourceKey=tools/referee/pssm/reader.go
sonar.issue.ignore.multicriteria.profileNamespace.ruleKey=go:S5332
sonar.issue.ignore.multicriteria.profileNamespace.resourceKey=internal/translate/xmi/sysmlv1/profiles.go
sonar.issue.ignore.multicriteria.typingJitter.ruleKey=javascript:S2245
sonar.issue.ignore.multicriteria.typingJitter.resourceKey=overrides/home.html
sonar.issue.ignore.multicriteria.runSeed.ruleKey=typescript:S2245
sonar.issue.ignore.multicriteria.runSeed.resourceKey=editors/vscode/src/landing/main.ts
sonar.issue.ignore.multicriteria.animationSteps.ruleKey=typescript:S9382
sonar.issue.ignore.multicriteria.animationSteps.resourceKey=editors/vscode/src/landing/main.ts
sonar.issue.ignore.multicriteria.kernelPermissions.ruleKey=python:S2612
sonar.issue.ignore.multicriteria.kernelPermissions.resourceKey=client/jupyter-kernel/jupyter_opensysml_kernel/*.py
sonar.issue.ignore.multicriteria.toolRunnerContext.ruleKey=godre:S8242
sonar.issue.ignore.multicriteria.toolRunnerContext.resourceKey=internal/exec/analysis/tool_runner.go
sonar.issue.ignore.multicriteria.keywordAuthoring.ruleKey=python:S107
sonar.issue.ignore.multicriteria.keywordAuthoring.resourceKey=client/python/opensysml/edit.py
sonar.issue.ignore.multicriteria.keywordChecking.ruleKey=python:S107
sonar.issue.ignore.multicriteria.keywordChecking.resourceKey=client/python/opensysml/connection.py
sonar.issue.ignore.multicriteria.wireRecord.ruleKey=python:S107
sonar.issue.ignore.multicriteria.wireRecord.resourceKey=client/python/opensysml/importcompare.py
sonar.issue.ignore.multicriteria.convertKeywords.ruleKey=python:S107
sonar.issue.ignore.multicriteria.convertKeywords.resourceKey=client/python/opensysml/__init__.py
sonar.issue.ignore.multicriteria.candidateTags.ruleKey=python:S8495
sonar.issue.ignore.multicriteria.candidateTags.resourceKey=client/python/opensysml/binary.py