# SonarCloud Configuration
# https://docs.sonarcloud.io/advanced-setup/analysis-parameters/

# Project identification
sonar.projectKey=kpeacocke_souschef
sonar.organization=kpeacocke
sonar.projectName=SousChef

# Source code configuration
# Directory-level source paths: all modules under souschef/ are included automatically.
# Add new top-level packages here when the project expands beyond these two roots.
sonar.sources=souschef,terraform-provider
sonar.tests=tests
sonar.sourceEncoding=UTF-8

# Python configuration
sonar.python.version=3.13
sonar.python.coverage.reportPaths=coverage.xml

# Go configuration
sonar.go.file.suffixes=.go
sonar.go.coverage.reportPaths=terraform-provider/coverage.out

# Ruby configuration (for Chef cookbooks - syntax analysis only, no coverage)
sonar.ruby.file.suffixes=.rb

# Exclusions
sonar.exclusions=**/node_modules/**,**/__pycache__/**,**/htmlcov/**,**/*.egg-info/**,mutants/**,terraform-provider/vendor/**
sonar.test.exclusions=tests/**,terraform-provider/internal/provider/*_test.go
sonar.coverage.exclusions=tests/**,examples/**,terraform-provider/internal/provider/*_test.go,terraform-provider/main_test.go

# Duplications
sonar.cpd.exclusions=tests/**,terraform-provider/coverage_*.html,terraform-provider/internal/provider/*_test.go

# Issue configuration
sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5,e6,e7,e8,e9,e10,e11,e12,e13,e14,e15
# Ignore "Cognitive Complexity" on test files
sonar.issue.ignore.multicriteria.e1.ruleKey=python:S3776
sonar.issue.ignore.multicriteria.e1.resourceKey=tests/**
# Ignore "Publicly writable directories" in test files (tempfile usage is secure)
sonar.issue.ignore.multicriteria.e2.ruleKey=python:S5443
sonar.issue.ignore.multicriteria.e2.resourceKey=tests/**
# Ignore "Hard-coded passwords" in test files (test data, not real secrets)
sonar.issue.ignore.multicriteria.e3.ruleKey=python:S2068
sonar.issue.ignore.multicriteria.e3.resourceKey=tests/**
# Ignore "Hard-coded IP addresses" in test files (test data)
sonar.issue.ignore.multicriteria.e4.ruleKey=python:S1313
sonar.issue.ignore.multicriteria.e4.resourceKey=tests/**
# Ignore "Clear-text protocols" in test files (test URLs, not real endpoints)
sonar.issue.ignore.multicriteria.e5.ruleKey=python:S5332
sonar.issue.ignore.multicriteria.e5.resourceKey=tests/**
# Ignore "Hard-coded IP addresses" in server.py (template examples in generated output)
sonar.issue.ignore.multicriteria.e6.ruleKey=python:S1313
sonar.issue.ignore.multicriteria.e6.resourceKey=souschef/server.py
# Ignore "Clear-text protocols" in server.py (Ansible template examples, not real URLs)
sonar.issue.ignore.multicriteria.e7.ruleKey=python:S5332
sonar.issue.ignore.multicriteria.e7.resourceKey=souschef/server.py
# Ignore "Hard-coded secrets" in server.py (AWX credential names, not actual secrets)
sonar.issue.ignore.multicriteria.e8.ruleKey=python:S6418
sonar.issue.ignore.multicriteria.e8.resourceKey=souschef/server.py
# Ignore "Slow regex" in server.py (Chef parsing requires complex patterns; inputs are trusted files)
sonar.issue.ignore.multicriteria.e9.ruleKey=python:S5852
sonar.issue.ignore.multicriteria.e9.resourceKey=souschef/server.py
# Ignore "Slow regex" in tests (test patterns for property-based testing)
sonar.issue.ignore.multicriteria.e10.ruleKey=python:S5852
sonar.issue.ignore.multicriteria.e10.resourceKey=tests/**
# Ignore "Redundant parentheses" - Ruff formatter enforces this style for multi-line strings
sonar.issue.ignore.multicriteria.e11.ruleKey=python:S1110
sonar.issue.ignore.multicriteria.e11.resourceKey=**/*.py
# Ignore "Untrusted path construction" in server.py at line 3031 (path validated via commonpath containment check)
sonar.issue.ignore.multicriteria.e12.ruleKey=pythonsecurity:S2083
sonar.issue.ignore.multicriteria.e12.resourceKey=souschef/server.py
# Ignore "Filesystem oracle attacks" in path_utils.py (multi-layer sanitization with character allowlist, null-byte rejection, and dual containment checks)
sonar.issue.ignore.multicriteria.e13.ruleKey=pythonsecurity:S6549
sonar.issue.ignore.multicriteria.e13.resourceKey=souschef/core/path_utils.py
# Ignore "Path injection" in path_utils.py (all paths validated via _resolve_path_under_base with realpath + commonpath + relative_to verification)
sonar.issue.ignore.multicriteria.e14.ruleKey=pythonsecurity:S2083
sonar.issue.ignore.multicriteria.e14.resourceKey=souschef/core/path_utils.py

# Suppress false-positive "Hard-coded password" in powershell.py: "update_password" is an Ansible
# parameter name (not a real credential); it specifies WHEN to update the password, not what the password is.
sonar.issue.ignore.multicriteria.e15.ruleKey=python:S2068
sonar.issue.ignore.multicriteria.e15.resourceKey=souschef/converters/powershell.py

# Coverage and Quality Gate
sonar.qualitygate.wait=true

# Coverage threshold is enforced via the SonarCloud Quality Gate configured in the
# SonarCloud UI (Administration > Quality Gates). The sonar.coverage.minimum property
# is not a recognised SonarCloud parameter and has no effect here.
