sonar-project.properties

# SonarCloud — CVE Radar (canonical scanner config)
# Setup: .github/SONARCLOUD.md · CI: .github/workflows/quality-sonarcloud.yml
#
# After enabling CI analysis, disable Automatic Analysis in SonarCloud:
# Project → Administration → Analysis Method → CI-based analysis only

sonar.projectKey=RaminNietzsche_CVE-Radar
sonar.organization=raminnietzsche
sonar.projectName=CVE Radar

sonar.sourceEncoding=UTF-8
sonar.sources=src,server,shared
sonar.tests=tests

# Postgres migration DDL — not Oracle PL/SQL; default .sql suffix triggers PLSQL analyzer
# and a data-dictionary warning (S3641, S3921, S3618, S3651).
sonar.plsql.file.suffixes=pks,pkb

sonar.test.inclusions=tests/**/*.test.ts
sonar.javascript.lcov.reportPaths=coverage/lcov.info
sonar.typescript.tsconfigPaths=tsconfig.app.json,tsconfig.server.json

# Python helper for extended-docs (MkDocs); matches docs CI (Python 3.12)
sonar.python.version=3.12

sonar.links.homepage=https://github.com/RaminNietzsche/CVE-Radar
sonar.links.ci=https://github.com/RaminNietzsche/CVE-Radar/actions/workflows/quality-sonarcloud.yml
sonar.links.issue=https://github.com/RaminNietzsche/CVE-Radar/issues
sonar.links.scm=https://github.com/RaminNietzsche/CVE-Radar

# Generated, vendor, and CI assets — not application logic
sonar.exclusions=\
  **/node_modules/**,\
  **/dist/**,\
  **/dist-server/**,\
  **/coverage/**,\
  public/icons/**,\
  extended-docs/docs/javascripts/vendor/**,\
  extended-docs/site/**,\
  docs/assets/**,\
  **/*.min.js,\
  **/*.min.css,\
  shared/ci/**,\
  .github/**,\
  server/db/migrations/**

# OpenAPI spec, scripts, upstream fetchers, and full scan orchestrator — covered indirectly or need live deps
sonar.coverage.exclusions=\
  tests/**,\
  **/*.test.ts,\
  server/openapi/**,\
  scripts/**,\
  server/handlers/scanHandlers.ts,\
  server/services/github.ts,\
  server/services/rss.ts,\
  server/services/translate.ts,\
  server/services/scan.ts,\
  server/services/enrich.ts

sonar.cpd.exclusions=tests/**,shared/compliance/cweToControls.ts