fix(sonar): exclude tests from duplication metrics - #4284
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
kwakayama has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
📦 Client bundle boundary
A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in |
|
Warning Review limit reachedNext included review available in 54 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughChangesSonarQube analysis configuration
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This change excludes test and spec files from duplication metrics while preserving issue visibility and coverage configuration; no actionable merge-blocking risk remains after normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ Approved 1 resolved / 1 findingsExcludes test and spec files from Sonar CPD duplication metrics to restore the New Code duplication gate, reducing reported duplication from 8.716% to approximately 0.909% in non-test code. Consider expanding the exclusion patterns to cover fixture, mock, and helper files ( ✅ 1 resolved✅ Quality: CPD exclusions miss fixture/mock/helper test files
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
There was a problem hiding this comment.
kwakayama has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Addressed the review suggestion in commit The CPD exclusion now also covers Verified the current repository has no duplicated New Code outside these test-support conventions that would be hidden by this change. |
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
|
Codex Review — APPROVEReviewed SHA: No actionable findings.
Verification: exact pinned diff and repository guidance inspected; Review-Gate: |
Supplying `urlTransform` replaces react-markdown's `defaultUrlTransform`, so `sanitizeUrl` is the only scheme guard left in a scaffolded chat app. It anchored both regexes at offset 0 over the raw string, but browsers ignore ASCII spaces and control characters while parsing a URL: a destination written as `[x](java	script:alert(1))` reaches the renderer as `java\tscript:alert(1)`, matches neither regex, and still navigates to `javascript:` when clicked. ` data:text/html,...` and a leading control character bypass it the same way. Match against a copy with those characters removed so an obfuscated scheme fails closed. The `img` override also emitted an anchor. Markdown allows a linked image (`[](href)`), which react-markdown renders through the `a` override, so that anchor nested inside another one - invalid HTML the browser repairs into a different tree than React rendered, which mismatches on hydration. Render inert text carrying the source in `title` instead; the surrounding link, when there is one, still works. templates/index.test.ts now runs the policy rather than grepping for it: it lifts `sanitizeUrl` out of each scaffolded renderer and asserts the obfuscated schemes are dropped and ordinary URLs survive. Each of the four bypasses above fails against the previous implementation. It also asserts the `img` override emits no anchor. Sonar's duplication gate reported 85.3% duplicated new lines because the five chat starters scaffold the same `app/markdown-renderer.tsx`. That parity is structural: every starter is copied verbatim into a generated project, so one starter's file cannot import a module from a sibling. Exclude `templates/files/**` from CPD, alongside the test-fixture exclusions added for the same reason in #4284. The files stay in `sonar.sources`, so their bugs, smells, and security issues are still reported. Claude-Session: https://claude.ai/code/session_01QfWNMiUhvWMKWi6BGfVdY3
1 participant
Summary
tests/tree from Sonar CPD duplication metrics.sonar.sourcesso Sonar issues remain visible and coverage configuration is unchanged.Evidence
SonarCloud main currently reports:
The current analysis attributes 17,938 of 18,526 duplicated New Code lines to test files. Non-test code accounts for 588 duplicated lines across 64,651 New Code lines (0.909%).
Verification
deno fmt --checkdeno task lintgit diff --checkThe local pre-push typecheck was blocked by pre-existing Deno/Node compatibility errors in the baseline checkout; the required CI typecheck remains authoritative.
Summary by CodeRabbit