SonarCloud: miscellaneous findings

7 open SonarCloud finding(s) in petry-projects/markets, worst severity MAJOR. Generated by the org SonarCloud Audit.

View in SonarCloud →

Findings

Rule	Count	Representative message
azurepipelines:S6505	5	Omitting "--ignore-scripts" allows lifecycle scripts to run during package installation.
azurepipelines:S8543	2	Define exact package version to avoid installing unverified releases.

Affected files

.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml (7)

Priority

Labeled priority:major — mapped from this bucket's worst SonarCloud severity (MAJOR).

Acceptance

All findings in this workstream resolved to zero in SonarCloud
No behavior change; CI green
Real fixes (no blanket NOSONAR unless a confirmed false positive, noted inline)

Idempotent issue — updated automatically each audit run; auto-closed when the finding count reaches zero.

SonarCloud Audit (2026-10-06): still open — 7 finding(s), worst severity MAJOR.

Dev-Lead: implementation deferred — automation PR queue is full

No pull request was opened for issue #504. The org-wide
open-automation-PR queue is currently at its signed-off cap (see
standards/pr-limits.json in petry-projects/.github).

This issue stays labeled dev-lead and will be re-attempted automatically once
the queue drains — no action is required.

SonarCloud Audit (2026-10-13): still open — 7 finding(s), worst severity MAJOR.

Dev-Lead Implementation Plan

Issue: #504 — SonarCloud: miscellaneous findings

Scope

Resolve the 7 SonarCloud findings (S6505 ×5, S8543 ×2) in .github/skills/bmad-testarch-ci/azure-pipelines-template.yaml with real fixes, no NOSONAR.

Implementation Checklist

S6505 (×3): npm ci → npm ci --ignore-scripts in the Lint, Test and BurnIn jobs (matches precedent in .github/workflows/ci.yml)
S6505 + S8543 (×2 each): replace npx playwright install --with-deps chromium with the locally installed, lockfile-pinned binary ./node_modules/.bin/playwright install --with-deps chromium — same binary npx resolved, but no on-the-fly unpinned package download
Update the header variable notes so generated pipelines keep the hardened form

Tests to Write

None — template/config-only change with no executable test surface (TDD exception; noted in report). Validation: YAML parse + dev-lead-lint.sh.

Test Command

python3 -c 'import yaml; yaml.safe_load(open(...))' + bash .dev-lead/scripts/dev-lead-lint.sh

Dev-Lead: Implementation Complete — PR #526

The implementation for issue #504 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.

Pull request: feat: implement issue #504 — SonarCloud: miscellaneous findings #526
Head commit: e90b0ecf6432ad26970575a261386db218726b0b
Net change against main: 1 file(s), +9/-7 lines
Run: https://github.com/petry-projects/markets/actions/runs/38474012292

Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.

feat: implement issue #504 — SonarCloud: miscellaneous findings (#526)

Navigation Menu

Repository navigation

SonarCloud: miscellaneous findings #504