mirror of
https://github.com/ansible-collections/kubernetes.core.git
synced 2026-07-25 08:54:51 +00:00
33bb3b81ba
Unit tests pass hardcoded '/tmp/...' strings as fake module arguments (for
example chart_ref) into fully mocked helm commands, so no file is ever
created and there is no real exposure. SonarCloud's python:S5443 still
raises a security hotspot on each literal and, because it only scores new
code, drops a PR's security rating even though the same pattern already
pervades the existing test suite.
Scope the suppression to tests/** only. Production code creates temporary
files via tempfile.mkstemp / NamedTemporaryFile and remains covered by the
rule, where it carries real value.
AI-assisted commit with Claude Opus
(cherry picked from commit 0836e96c2d)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
31 lines
1.4 KiB
Properties
31 lines
1.4 KiB
Properties
# SonarCloud project configuration for kubernetes.core
|
|
# Parameters: https://docs.sonarqube.org/latest/analysis/analysis-parameters/
|
|
|
|
sonar.projectKey=ansible-collections_kubernetes.core
|
|
sonar.organization=ansible-collections
|
|
sonar.sources=.
|
|
sonar.projectName=kubernetes.core
|
|
sonar.python.coverage.reportPaths=coverage.xml
|
|
|
|
sonar.tests=tests/unit,tests/integration
|
|
sonar.python.version=3.12
|
|
sonar.newCode.referenceBranch=stable-5
|
|
|
|
sonar.exclusions=tests/**,.tox/**
|
|
|
|
# Ansible module argument_spec is conventionally defined with the dict(...)
|
|
# constructor (not {...} literals) for readability and consistency across the
|
|
# collection. Suppress python:S7498 ("prefer literal syntax"), which conflicts
|
|
# with that convention and otherwise re-fires on every new module argument.
|
|
sonar.issue.ignore.multicriteria=e1,e2
|
|
sonar.issue.ignore.multicriteria.e1.ruleKey=python:S7498
|
|
sonar.issue.ignore.multicriteria.e1.resourceKey=**/*.py
|
|
|
|
# Unit tests pass hardcoded '/tmp/...' strings as fake module arguments (e.g.
|
|
# chart_ref) to fully mocked commands; no file is ever created there. Suppress
|
|
# python:S5443 ("temporary files in publicly writable directories") for test
|
|
# code only. Production code creates temp files via tempfile.mkstemp /
|
|
# NamedTemporaryFile and stays covered by the rule.
|
|
sonar.issue.ignore.multicriteria.e2.ruleKey=python:S5443
|
|
sonar.issue.ignore.multicriteria.e2.resourceKey=tests/**/*.py
|