Fix the red SonarCloud gate on main - #96
Merged
Merged
Conversation
The New Code definition is "previous version" and no analysis ever ran with one, so the period falls back to the first analysis ever: 3562 new lines for 3334 lines of code, the whole code base. That is what turned the main gate red on new_coverage and new_security_rating as soon as #94 published coverage. Pull requests were never affected, their gate is computed on their own diff. Pass the version from pyproject.toml, which stays the single source of truth, so each release gives the period a real boundary. Signed-off-by: Florent Carli <florent.carli@rte-france.com>
The application authenticates nobody. In production the vmmgrapi role of seapath/ansible serves it with gunicorn behind an nginx that carries the TLS, the basic auth and the ACL, and main() is not that path: gunicorn imports wsgi:app. On 0.0.0.0 this debug entry point published every route, /start and /stop included, in clear text on every interface. Fixes python:S8392. Signed-off-by: Florent Carli <florent.carli@rte-france.com>
A version so a rebuild cannot pick up a new release on its own, and --only-binary :all: so no dependency runs a setup script at install time, as commit 9217d68 did for the workflow steps. Fixes docker:S8544 and docker:S8541. 0.6.0 is what the unpinned line already resolved to on the python3.10 of ubuntu 22.04, so the image does not change. Signed-off-by: Florent Carli <florent.carli@rte-france.com>
The sonar flavor aimed sonar-scanner 4.7.0 at http://j1.sfl.team:9000/, an SFL instance this repository no longer reports to: commit 1dd9bdf moved the analysis to SonarCloud, run from the workflow. Removing it also takes openjdk-8-jre-headless, unzip and wget out of the image, which nothing else uses, and fixes docker:S6506, the download following redirects unchecked, and docker:S5332, the clear-text URL. Signed-off-by: Florent Carli <florent.carli@rte-france.com>
vm_manager_api.py was at 0%, so the single line the previous commit changed failed this pull request's own gate: 1 new line to cover, 0 covered. Cover the four routes, both branches of execfunc and main(), with every vm_manager call replaced. The module reaches 94%, the rest being the __main__ guard. The main() test asserts the bind address. Signed-off-by: Florent Carli <florent.carli@rte-france.com>
insatomcat
force-pushed
the
sonar-new-code-baseline
branch
from
August 6, 2026 10:57
6415501 to
34c63d1
Compare
|
eroussy
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishing coverage in #94 turned the
maingate red. Nothing regressed:new_coveragewas simply an ignored condition as long as no report existed.The project's New Code definition is "previous version", and every analysis in the history ran without one. With no version event to compare against, the period falls back to the first analysis ever, dated 2024-07-31:
new_lines3562 forncloc3334, so the entire code base counts as new code. Hencenew_coverage21.1 against a threshold of 80, andnew_security_ratingC from findings dating back to 2021. Pull requests were never affected, their gate is computed on their own diff.The first commit is the fix, the others clear the security findings that are worth clearing:
ci:pass the version frompyproject.tomlto the scanner, so each release gives the period a real boundary.api:the Flask debug entry point listened on0.0.0.0while the application authenticates nobody, publishing/startand/stopin clear text around the nginx that carries the TLS, the basic auth and the ACL. It is not the production path, gunicorn importswsgi:app. Fixespython:S8392, the only blocker.cqfd:pinsphinx-argparseand install it from wheels only, as the workflow steps already are. Fixesdocker:S8544anddocker:S8541.cqfd:drop the sonar-scanner 4.7.0 aimed athttp://j1.sfl.team:9000/, which this repository no longer reports to since the analysis moved to the workflow. Takes openjdk-8, unzip and wget out of the image, and fixesdocker:S6506anddocker:S5332.tests:cover the REST API, 0% to 94%. Without it the single line changed above, in a module at 0%, failed this pull request's own gate: 1 new line to cover, 0 covered.Six of the ten security findings clear. The remaining four,
pythonsecurity:S8701andS8707on paths built from argparse arguments, need real input validation rather than a one-line fix and are left out.