mirror of
https://github.com/ansible-collections/kubernetes.core.git
synced 2026-07-25 00:44:40 +00:00
6bb9cce51b
* feat(ci): add security check to block .claude/ and .vscode/ directories Add workflow that calls the security_check_directories action from cloud-content-ci-automation to fail PRs containing files under .claude/ or .vscode/ directories. Integrates with all_green_check.yaml as a required job for PRs. Ref: ACA-6411 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): suppress SonarCloud S7637 for reusable actions using @main Internal reusable actions from ansible-network/github_actions and ansible-collections/cloud-content-ci-automation use @main refs for simpler maintenance. Suppress the 'use full commit SHA' rule for workflow files. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): use correct org and pin action to commit SHA Address review feedback: - Change org from ansible-collections to ansible - Pin to commit SHA 74b5fe87 instead of @main Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs: add changelog fragment for security check workflow Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Update changelogs/fragments/1173-security-check-workflow.yml --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Bianca Henderson <beeankha@gmail.com>
37 lines
1.7 KiB
Properties
37 lines
1.7 KiB
Properties
# SonarCloud project configuration for kubernetes.core
|
|
# Parameters: https://docs.sonarqube.org/latest/analysis/analysis-parameters/
|
|
|
|
sonar.projectKey=ansible-collections_kubernetes.core
|
|
sonar.organization=ansible-collections
|
|
sonar.sources=.
|
|
sonar.projectName=kubernetes.core
|
|
sonar.python.coverage.reportPaths=coverage.xml
|
|
|
|
sonar.tests=tests/unit,tests/integration
|
|
sonar.python.version=3.12
|
|
sonar.newCode.referenceBranch=main
|
|
|
|
sonar.exclusions=tests/**,.tox/**
|
|
|
|
# Ansible module argument_spec is conventionally defined with the dict(...)
|
|
# constructor (not {...} literals) for readability and consistency across the
|
|
# collection. Suppress python:S7498 ("prefer literal syntax"), which conflicts
|
|
# with that convention and otherwise re-fires on every new module argument.
|
|
sonar.issue.ignore.multicriteria=e1,e2,e3
|
|
sonar.issue.ignore.multicriteria.e1.ruleKey=python:S7498
|
|
sonar.issue.ignore.multicriteria.e1.resourceKey=**/*.py
|
|
|
|
# Unit tests pass hardcoded '/tmp/...' strings as fake module arguments (e.g.
|
|
# chart_ref) to fully mocked commands; no file is ever created there. Suppress
|
|
# python:S5443 ("temporary files in publicly writable directories") for test
|
|
# code only. Production code creates temp files via tempfile.mkstemp /
|
|
# NamedTemporaryFile and stays covered by the rule.
|
|
sonar.issue.ignore.multicriteria.e2.ruleKey=python:S5443
|
|
sonar.issue.ignore.multicriteria.e2.resourceKey=tests/**/*.py
|
|
|
|
# GitHub Actions workflows in this repo use @main for internal reusable actions
|
|
# (ansible-network/github_actions, ansible-collections/cloud-content-ci-automation)
|
|
# to simplify maintenance. Suppress githubactions:S7637 ("use full commit SHA").
|
|
sonar.issue.ignore.multicriteria.e3.ruleKey=githubactions:S7637
|
|
sonar.issue.ignore.multicriteria.e3.resourceKey=.github/workflows/**/*.yaml
|