SonarCloud: miscellaneous findings

6 open SonarCloud finding(s) in combsmith/broodly, worst severity BLOCKER. Generated by the org SonarCloud Audit.

Findings

Rule	Count	Representative message
docker:S6471	2	This image might run with "root" as the default user. Make sure it is safe here.
terraform:S6258	2	Omitting "database_flags.log_connections" makes logs incomplete. Make sure it is safe here
terraform:S6329	1	Make sure allowing public network access is safe here.
terraform:S6403	1	Omitting "ssl_mode" allows unencrypted connections to the database.

Affected files

infra/terraform/modules/cloud-sql/main.tf (3)
apps/api/Dockerfile (1)
apps/api/Dockerfile.worker (1)
infra/terraform/modules/storage/main.tf (1)

Priority

Labeled priority:blocker — mapped from this bucket's worst SonarCloud severity (BLOCKER).

Acceptance

All findings in this workstream resolved to zero in SonarCloud
No behavior change; CI green
Real fixes (no blanket NOSONAR unless a confirmed false positive, noted inline)

Idempotent issue — updated automatically each audit run; auto-closed when the finding count reaches zero.

SonarCloud Audit (2026-10-27): still open — 6 finding(s), worst severity BLOCKER.

Dev-Lead Implementation Plan

Issue: #614 — SonarCloud: miscellaneous findings

Scope

Resolve the 6 SonarCloud findings with real hardening fixes in the API Dockerfiles and the Cloud SQL / storage Terraform modules. Use one justified inline NOSONAR only where the fix would break connectivity.

Implementation Checklist

apps/api/Dockerfile, apps/api/Dockerfile.worker (docker:S6471): run the final distroless stage as USER nonroot:nonroot
infra/terraform/modules/cloud-sql/main.tf (terraform:S6258): add log_connections, log_disconnections, log_checkpoints, log_lock_waits database flags
infra/terraform/modules/cloud-sql/main.tf (terraform:S6403): set ssl_mode = "ENCRYPTED_ONLY". This is compatible with the existing /cloudsql Auth Proxy connector.
infra/terraform/modules/cloud-sql/main.tf (terraform:S6329): Cloud Run reaches the instance through the Cloud SQL connector over public IP, because there is no VPC/private service access. Disabling ipv4_enabled would break the API. Keep it with an inline, justified NOSONAR, and add a validation to authorized_networks in variables.tf that rejects 0.0.0.0/0.
infra/terraform/modules/storage/main.tf (terraform:S6258): add a dedicated access-log bucket and a logging block on the media bucket. Grant cloud-storage-analytics@google.com objectCreator on the log bucket.

Tests to Write

tests/scripts/sonar-infra-hardening.test.sh: static guard asserting each fix above is present

Test Command

bash tests/scripts/sonar-infra-hardening.test.sh (+ existing tests/scripts/*.test.sh, terraform fmt -check / validate if available)

Dev-Lead: Implementation Complete — PR #624

The implementation for issue #614 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.

Pull request: feat: implement issue #614 — SonarCloud: miscellaneous findings #624
Head commit: 5d9ebb4c7577db1efde0e70e528c6022c1afa3b1
Net change against main: 7 file(s), +172/-1 lines
Run: https://github.com/combsmith/broodly/actions/runs/40585892693

Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.

Navigation Menu

Repository navigation

SonarCloud: miscellaneous findings #614