sonar-project.properties

# NOTE:
# - Do not include sonar.projectVersion or sonar.projectName as these are set automatically by the pipeline
# - Customize sonar.sources, sonar.exclusions, sonar.coverage.exclusions, sonar.tests and sonar
#   unit test coverage reports based on your project

# Refer to https://docs.sonarqube.org/latest/project-administration/narrowing-the-focus/
# for details on sources and exclusions. Note also .gitignore which is used by sonarqube
#
sonar.sources=.

# .git/ not available from codecommit
sonar.scm.disabled = true

# Focusing sonarqube analysis on non test code first and reducing noise from analysis of test code. Projects
# can customize the exclusions to include analyzing of test code if desired
# Removed protobuf generated files
# Remove testing packages from code coverage
# Remove xml files
# Removed experimental features (migrationConsoleApi, dashboardsSanitizer)
sonar.exclusions=\
    **/build/**, \
    **/buildSrc/**, \
    **/*Test*/**, \
    **/*test*/**, \
    **/node_modules/**, \
    **/cdk.out/**, \
    **/config/**, \
    **/*.xml, \
    **/*.config, \
    **/migrationAssistantWithArgo/**, \
    **/dashboardsSanitizer/**, \
    **/DocumentsFromSnapshotMigration/docker/**, \
    **/jenkinsdocker/**, \
    **/__init__.py, \
    **/testAutomation/**, \
    **/integ_test/**, \
    **/setup.py, \
    **/jest.config.js, \
    **/coverage/**/*, \
    **/frontend/out/**, \
    **/generated/**, \
    **/orchestrationSpecs/**

# Code coverage Specific Properties
# sonar.coverage.exclusions=

# For Java tests
sonar.coverage.jacoco.xmlReportPaths=**/jacoco*Report.xml
sonar.java.source=11
sonar.java.binaries=.

# For Python tests
sonar.python.version = 3.11
sonar.python.coverage.reportPaths= **/coverage.xml

# For JavaScript/TypeScript tests
sonar.javascript.lcov.reportPaths= **/lcov.info

# Encoding of the source files
sonar.sourceEncoding=UTF-8

# Rule specific exclusions
sonar.issue.ignore.multicriteria = \
  p1, p2, p3, p4, p5, p6, p7, p8, p9, p10, p11, \
  ts1, ts2, ts3, ts4, ts5, ts6, ts7, ts8, ts9, ts10, ts11, ts12, ts13, ts14, ts15, \
  todo1, todo2, todo3, todo4, \
  j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15, j16, j17, j18, j19, j20, j21, j22, \
  autoclose1, autoclose2, \
  comp1, comp2, comp3, comp4, \
  loop1, loop2, loop3, loop4, loop5, loop6, loop7, \
  f1, f2, f3, f4, f5, f6, f7, f8, f9, \
  d1, d2, d3, d4, d5, d6, \
  js1, js2

sonar.issue.ignore.multicriteria.p1.ruleKey = python:S1135
sonar.issue.ignore.multicriteria.p1.resourceKey = **/*.py

# Ignore complexity on environment __init__ method
sonar.issue.ignore.multicriteria.p2.ruleKey = python:S3776
sonar.issue.ignore.multicriteria.p2.resourceKey = **/environment.py

# SonarQube Issues - Ignore cognitive complexity for workflow files
sonar.issue.ignore.multicriteria.p3.ruleKey = python:S3776
sonar.issue.ignore.multicriteria.p3.resourceKey = **/console_link/workflow/commands/approve.py

sonar.issue.ignore.multicriteria.p4.ruleKey = python:S3776
sonar.issue.ignore.multicriteria.p4.resourceKey = **/console_link/workflow/commands/status.py

sonar.issue.ignore.multicriteria.p5.ruleKey = python:S3776
sonar.issue.ignore.multicriteria.p5.resourceKey = **/console_link/workflow/services/workflow_service.py

# Ignore complexity on tree_state_manager methods
sonar.issue.ignore.multicriteria.p6.ruleKey = python:S3776
sonar.issue.ignore.multicriteria.p6.resourceKey = **/console_link/workflow/tui/tree_state_manager.py

# Ignore complexity on manage_injections methods
sonar.issue.ignore.multicriteria.p7.ruleKey = python:S3776
sonar.issue.ignore.multicriteria.p7.resourceKey = **/console_link/workflow/tui/manage_injections.py

# Ignore complexity on live_status_manager methods
sonar.issue.ignore.multicriteria.p8.ruleKey = python:S3776
sonar.issue.ignore.multicriteria.p8.resourceKey = **/console_link/workflow/tui/live_status_manager.py

# Ignore complexity on tree_utils methods
sonar.issue.ignore.multicriteria.p9.ruleKey = python:S3776
sonar.issue.ignore.multicriteria.p9.resourceKey = **/console_link/workflow/tree_utils.py

# Ignore complexity on autocomplete_k8s_labels methods
sonar.issue.ignore.multicriteria.p10.ruleKey = python:S3776
sonar.issue.ignore.multicriteria.p10.resourceKey = **/console_link/workflow/commands/autocomplete_k8s_labels.py

# Ignore complexity on tree_utils methods
sonar.issue.ignore.multicriteria.p11.ruleKey = python:S3776
sonar.issue.ignore.multicriteria.p11.resourceKey = **/console_link/workflow/commands/output.py

sonar.issue.ignore.multicriteria.ts1.ruleKey = typescript:S1135
sonar.issue.ignore.multicriteria.ts1.resourceKey = **/*.ts

# CDK typescript requires resources to be created which aren't actually used in code but will be used in CFN template generation
sonar.issue.ignore.multicriteria.ts2.ruleKey = typescript:S1848
sonar.issue.ignore.multicriteria.ts2.resourceKey = **/*.ts

# We use an empty class (ClusterNoAuth) to receive a configuration option from the CDK Context
sonar.issue.ignore.multicriteria.ts3.ruleKey = typescript:S2094
sonar.issue.ignore.multicriteria.ts3.resourceKey = **/common-utilities.ts

# Disable complexity check for our CDK code; we know it's rough and a refactor will be risky and time consuming
# without an obvious payoff given its slow rate of change and our intention to replace it entirely
sonar.issue.ignore.multicriteria.ts4.ruleKey = typescript:S3776
sonar.issue.ignore.multicriteria.ts4.resourceKey = **/cdk/opensearch-service-migration/**/*.ts

# Ignore a hardcoded password for an OpenSearch stack used soley for integ testing purposes
# and called out as such.
sonar.issue.ignore.multicriteria.ts5.ruleKey = typescript:S2068
sonar.issue.ignore.multicriteria.ts5.resourceKey = **/cdk/opensearch-service-migration/**/opensearch-container-stack.ts

# Allow usage of the /tmp directory.  This directory is used to temporarily download the snapshot
# into the ephemeral storage of a Fargate container with a single process running on it and a
# limited lifespan; seems safe to me.
sonar.issue.ignore.multicriteria.ts6.ruleKey = typescript:S5443
sonar.issue.ignore.multicriteria.ts6.resourceKey = **/cdk/opensearch-service-migration/**/reindex-from-snapshot-stack.ts

# Allow usage of the /tmp directory to store logs inside of a Kafka container
sonar.issue.ignore.multicriteria.ts7.ruleKey = typescript:S5443
sonar.issue.ignore.multicriteria.ts7.resourceKey = **/cdk/opensearch-service-migration/**/kafka-stack.ts

# Don't require versioning on a bucket that doesn't need it (the RFS SNapshot bucket)
sonar.issue.ignore.multicriteria.ts8.ruleKey = typescript:S6252
sonar.issue.ignore.multicriteria.ts8.resourceKey = **/cdk/opensearch-service-migration/**/migration-assistance-stack.ts

# Allow users to make the RFS Snapshot bucket public, even though it is private by default.
# Enables them to write to the bucket from anywhere (e.g. on-prem).
sonar.issue.ignore.multicriteria.ts9.ruleKey = typescript:S6281
sonar.issue.ignore.multicriteria.ts9.resourceKey = **/cdk/opensearch-service-migration/**/migration-assistance-stack.ts

# Allow any AWS caller to access the OpenSearch Target Domain used in integration tests
# and is vpc-isolated
sonar.issue.ignore.multicriteria.ts10.ruleKey = typescript:S6270
sonar.issue.ignore.multicriteria.ts10.resourceKey = **/cdk/opensearch-service-migration/**/opensearch-domain-stack.ts

# Ignore "Boolean literals should not be used in comparisons" to be clear about how undefined would be handled
sonar.issue.ignore.multicriteria.ts11.ruleKey = typescript:S1125
sonar.issue.ignore.multicriteria.ts11.resourceKey = **/cdk/opensearch-service-migration/**/*.ts

# Ternary operators are often used as part of frontend UX design
sonar.issue.ignore.multicriteria.ts12.ruleKey = typescript:S3358
sonar.issue.ignore.multicriteria.ts12.resourceKey = **/frontend/**/*.tsx

# Ignore "unexpected negated condition", writing all ternary statements in with positive conditions isn't useful.
sonar.issue.ignore.multicriteria.ts13.ruleKey = typescript:S7735
sonar.issue.ignore.multicriteria.ts13.resourceKey = **/*.ts*

# Ignore "Use `for…of` instead of `.forEach(…)`.", while there can be perf tradeoffs this is not required
sonar.issue.ignore.multicriteria.ts14.ruleKey = typescript:S7728
sonar.issue.ignore.multicriteria.ts14.resourceKey = **/*.ts*

# Ignore "Prefer `node:crypto` over `crypto`", this is frontend code running on a browser, not running in nodejs
sonar.issue.ignore.multicriteria.ts15.ruleKey = typescript:S7772
sonar.issue.ignore.multicriteria.ts15.resourceKey = **/src/hooks/**


# Ignore TODO occurrences.
sonar.issue.ignore.multicriteria.todo1.ruleKey = java:S1135
sonar.issue.ignore.multicriteria.todo1.resourceKey = **/*

sonar.issue.ignore.multicriteria.todo2.ruleKey = kubernetes:S1135
sonar.issue.ignore.multicriteria.todo2.resourceKey = **/*

sonar.issue.ignore.multicriteria.todo3.ruleKey = javascript:S1135
sonar.issue.ignore.multicriteria.todo3.resourceKey = **/*

sonar.issue.ignore.multicriteria.todo4.ruleKey = typescript:S1135
sonar.issue.ignore.multicriteria.todo4.resourceKey = **/*


# Ignore System.*.println statements, we use them thoughtfully to alert the user on startup especially
# when logging may be misconfigured.
sonar.issue.ignore.multicriteria.j2.ruleKey = java:S106
sonar.issue.ignore.multicriteria.j2.resourceKey = **/*.java

# Ignore rule java:S2658 - This rule flags the use of asserts to check the parameters of a public method.
# This is used for checks that are included in the application but are too expensive to perform at runtime.
sonar.issue.ignore.multicriteria.j3.ruleKey = java:S4274
sonar.issue.ignore.multicriteria.j3.resourceKey = **/*.java

# Ignore class naming conventions for versioned RFS classes which contain underscores
sonar.issue.ignore.multicriteria.j4.ruleKey = java:S101
sonar.issue.ignore.multicriteria.j4.resourceKey = **/bulkload/version_*/*.java

# Ignore constructor parameter limits for Java classes
sonar.issue.ignore.multicriteria.j5.ruleKey = java:S107
sonar.issue.ignore.multicriteria.j5.resourceKey = **/*.java

# Ignore SonarQube when it tries to remove curly braces that make the code easier to read
sonar.issue.ignore.multicriteria.j6.ruleKey = java:S1602
sonar.issue.ignore.multicriteria.j6.resourceKey = **/*.java

# Ignore class naming conventions for versioned RFS classes which contain underscores
sonar.issue.ignore.multicriteria.j7.ruleKey = java:S101
sonar.issue.ignore.multicriteria.j7.resourceKey = **/bulkload/transformers/*.java

# Ignore switch statement warnings when the number of cases is low.
sonar.issue.ignore.multicriteria.j8.ruleKey = java:S1301
sonar.issue.ignore.multicriteria.j8.resourceKey = **/*.java

# Ignore Singleton design pattern warnings
sonar.issue.ignore.multicriteria.j9.ruleKey = java:S6548
sonar.issue.ignore.multicriteria.j9.resourceKey = **/*.java

# Ignore "Remove this method and declare a constant for this value."
sonar.issue.ignore.multicriteria.j10.ruleKey = java:S3400
sonar.issue.ignore.multicriteria.j10.resourceKey = **/*.java

# Ignore "This block of commented-out lines of code should be removed."
sonar.issue.ignore.multicriteria.j11.ruleKey = java:S125
sonar.issue.ignore.multicriteria.j11.resourceKey = **/*.java

# Ignore "Remove usage of generic wildcard type." - we had 8 places where we return values w/ wildcards.
# I don't see an easy workaround that keeps the same semantics.  It's a shame that the wildcard detection
# isn't more sophisticated to tell when this is actually an issue.
sonar.issue.ignore.multicriteria.j12.ruleKey = java:S1452
sonar.issue.ignore.multicriteria.j12.resourceKey = **/*.java

# Ignore Set the credentials provider explicitly on this builder, false positive.
sonar.issue.ignore.multicriteria.j13.ruleKey = java:S6242
sonar.issue.ignore.multicriteria.j13.resourceKey = **/*.java

# Ignore Set the region explicitly on this builder, false positive.
sonar.issue.ignore.multicriteria.j14.ruleKey = java:S6241
sonar.issue.ignore.multicriteria.j14.resourceKey = **/*.java

# Ignore use of clone when extending interface that requires it
sonar.issue.ignore.multicriteria.j15.ruleKey = java:S2975
sonar.issue.ignore.multicriteria.j15.resourceKey = **/*CompressionMode.java
sonar.issue.ignore.multicriteria.j16.ruleKey = java:S1182
sonar.issue.ignore.multicriteria.j16.resourceKey = **/*CompressionMode.java
sonar.issue.ignore.multicriteria.j17.ruleKey = java:S3011
sonar.issue.ignore.multicriteria.j17.resourceKey = **/jcommander/*.java
sonar.issue.ignore.multicriteria.j18.ruleKey = java:S3776
sonar.issue.ignore.multicriteria.j18.resourceKey = **/*JsonCommandLineParser.java
sonar.issue.ignore.multicriteria.j19.ruleKey = java:S135
sonar.issue.ignore.multicriteria.j19.resourceKey = **/*JsonCommandLineParser.java
sonar.issue.ignore.multicriteria.j20.ruleKey = java:S3358
sonar.issue.ignore.multicriteria.j20.resourceKey = **/*JsonCommandLineParser.java

# Ignore package naming convention for KNN codec packages (must match OpenSearch KNN plugin for Lucene SPI)
sonar.issue.ignore.multicriteria.j21.ruleKey = java:S120
sonar.issue.ignore.multicriteria.j21.resourceKey = **/knn/index/codec/**/*.java

# False positive - would require many other unrelated contracts to need to change
sonar.issue.ignore.multicriteria.j22.ruleKey = java:S1450
sonar.issue.ignore.multicriteria.j22.resourceKey = **/trafficReplayer/**/replay/ClientConnectionPool.java


# "Use try-with-resources or close this"
# We use AutoCloseable for tracing contexts so that we can properly record spans
# and metrics at the completion of activities.  Since many of our contexts tend to
# be closed in code that runs asynchronously from when it was created, this makes
# a try-with-resources block a non-starter.  It's unfortunate that there isn't
# another way to check all other auto-closeable values OTHER than instrumentation
# contexts.
#
# This is a good one to run audits on to make sure that we have close paths setup.
# It's also good to make sure that we're dealing with other AutoCloseables as effectively
# as possible.
sonar.issue.ignore.multicriteria.autoclose1.ruleKey = java:S2095
sonar.issue.ignore.multicriteria.autoclose1.resourceKey = **/TrafficCapture/**/*.java
sonar.issue.ignore.multicriteria.autoclose2.ruleKey = java:S2095
sonar.issue.ignore.multicriteria.autoclose2.resourceKey = **/lucene/version_*/IndexReader*.java



# Cognitive complexity scores are too high for the files specified below.
# In most cases, the code is for specific state machines and very carefully constructed code.
# Refactoring to maintain correctness and efficiency would be nice, but making the solution require
# LESS cognitive load will be a sizeable challenge!
sonar.issue.ignore.multicriteria.comp1.ruleKey = java:S3776
sonar.issue.ignore.multicriteria.comp1.resourceKey = **/BlockingTrafficSource.java

sonar.issue.ignore.multicriteria.comp2.ruleKey = java:S3776
sonar.issue.ignore.multicriteria.comp2.resourceKey = **/NettyJsonBodyAccumulateHandler.java

sonar.issue.ignore.multicriteria.comp3.ruleKey = java:S3776
sonar.issue.ignore.multicriteria.comp3.resourceKey = **/NettyJsonToByteBufHandler.java

sonar.issue.ignore.multicriteria.comp4.ruleKey = java:S3776
sonar.issue.ignore.multicriteria.comp4.resourceKey = **/HeaderRemoverHandler.java



# Some loops are better with multiple exits
sonar.issue.ignore.multicriteria.loop1.ruleKey = java:S135
sonar.issue.ignore.multicriteria.loop1.resourceKey = **/OpenSearchDefaultRetry.java

sonar.issue.ignore.multicriteria.loop2.ruleKey = java:S135
sonar.issue.ignore.multicriteria.loop2.resourceKey = **/TrafficReplayerCore.java

sonar.issue.ignore.multicriteria.loop3.ruleKey = java:S135
sonar.issue.ignore.multicriteria.loop3.resourceKey = **/TrafficReplayerTopLevel.java

sonar.issue.ignore.multicriteria.loop4.ruleKey = java:S135
sonar.issue.ignore.multicriteria.loop4.resourceKey = **/HeaderRemoverHandler.java

sonar.issue.ignore.multicriteria.loop5.ruleKey = java:S135
sonar.issue.ignore.multicriteria.loop5.resourceKey = **/NettyJsonToByteBufHandler.java

sonar.issue.ignore.multicriteria.loop6.ruleKey = java:S135
sonar.issue.ignore.multicriteria.loop6.resourceKey = **/OpenSearchWorkCoordinator.java

sonar.issue.ignore.multicriteria.loop7.ruleKey = java:S135
sonar.issue.ignore.multicriteria.loop7.resourceKey = **/ActiveContextMonitor.java


# Ignore "Define a constant instead of duplicating this literal..."
sonar.issue.ignore.multicriteria.f1.ruleKey = java:S1192
sonar.issue.ignore.multicriteria.f1.resourceKey = **/OpenSearchWorkCoordinator*.java

# Ignore empty class
sonar.issue.ignore.multicriteria.f2.ruleKey = java:S2094
sonar.issue.ignore.multicriteria.f2.resourceKey = **/replay/**/EndOfInput.java

# Throwable and Error should not be caught
# The Top-Level traffic replayer catches Throwables to orchestrates a shutdown
sonar.issue.ignore.multicriteria.f3.ruleKey = java:S1181
sonar.issue.ignore.multicriteria.f3.resourceKey = **/TrafficReplayerTopLevel.java

# Empty arrays and collections should be returned instead of null
# Testing for empty would require more code to be safe, so that's a bad idea
sonar.issue.ignore.multicriteria.f4.ruleKey = java:S1168
sonar.issue.ignore.multicriteria.f4.resourceKey = **/TrafficStreamUtils.java

# "/" is a URI path delimiter and it's more readable than any other option
sonar.issue.ignore.multicriteria.f5.ruleKey = java:S1075
sonar.issue.ignore.multicriteria.f5.resourceKey = **/OpenSearchClient.java

# A single extension of a netty class makes the class inheritance depth go deeper than Sonar would like
sonar.issue.ignore.multicriteria.f6.ruleKey = java:S110
sonar.issue.ignore.multicriteria.f6.resourceKey = **/LoggingHttpHandler.java

# Ignore "Remove this useless assignment to local variable...".
# The code uses literal variable names to help with readability
sonar.issue.ignore.multicriteria.f7.ruleKey = java:S1854
sonar.issue.ignore.multicriteria.f7.resourceKey = **/ReplayEngine.java

# Ignore 'Do something with the "!Unknown!" value returned by "tryAcquire"'
# There is a call to tryAcquire on a semaphore whose return value isn't tested
# because we immediately test for the condition again within a loop.
# There's no reason to add more branches to already complicated and sensitive code.
sonar.issue.ignore.multicriteria.f8.ruleKey = java:S899
sonar.issue.ignore.multicriteria.f8.resourceKey = **/BlockingTrafficSource.java

# This jump is not trivial to ignore due to side-effects in the calling patterns
sonar.issue.ignore.multicriteria.f9.ruleKey = java:S3626
sonar.issue.ignore.multicriteria.f9.resourceKey = **/NettyJsonContentCompressor.java

# We use some base Docker images that run as root; changing the default user in these containers
# doesn't make sense
sonar.issue.ignore.multicriteria.d1.ruleKey = docker:S6471
sonar.issue.ignore.multicriteria.d1.resourceKey = **/Dockerfile

# MigrationConsole image (both base and staging) are reusing docker image built in this project,
# using the `latest` tag is fine for this project.
sonar.issue.ignore.multicriteria.d2.ruleKey = docker:S6596
sonar.issue.ignore.multicriteria.d2.resourceKey = **/migrationConsole*/Dockerfile

# Surrounding all variables with quoting rule isn't needed since docker images parameters are strictly controlled.
sonar.issue.ignore.multicriteria.d3.ruleKey = docker:S6570
sonar.issue.ignore.multicriteria.d3.resourceKey = **/Dockerfile

# Too long run instructions is more of a style complaint than a real issue to address.
sonar.issue.ignore.multicriteria.d4.ruleKey = docker:S7020
sonar.issue.ignore.multicriteria.d4.resourceKey = **/Dockerfile

# While consolidating multiple RUN commands creates fewer image layers, the current format works as is.
sonar.issue.ignore.multicriteria.d5.ruleKey = docker:S7031
sonar.issue.ignore.multicriteria.d5.resourceKey = **/Dockerfile

# Do not use ADD in place of curl as it has not proven to be more reliable
sonar.issue.ignore.multicriteria.d6.ruleKey = docker:S7026
sonar.issue.ignore.multicriteria.d6.resourceKey = **/Dockerfile

# Ignore "unexpected negated condition", writing all ternary statements in with positive conditions isn't useful.
sonar.issue.ignore.multicriteria.js1.ruleKey = javascript:S7735
sonar.issue.ignore.multicriteria.js1.resourceKey = **/*.js

# Ignore "Use `for…of` instead of `.forEach(…)`.", while there can be perf tradeoffs this is not required
sonar.issue.ignore.multicriteria.js2.ruleKey = javascript:S7728
sonar.issue.ignore.multicriteria.js2.resourceKey = **/*.js