Repository navigation
feat: implement issue #504 — SonarCloud: miscellaneous findings - #526
Conversation
don-petry
added
the
auto-rebase:ready
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
CodeAnt PR Risk: Medium Risk
Assessed commit: |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #526 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but I can't mark it done yet: required check |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Azure Pipelines template to run npm ci with the --ignore-scripts flag and replaces global npx execution of Playwright with a local binary path to ensure lockfile-pinned execution. The review feedback recommends using npx --no-install instead of the direct path to ./node_modules/.bin/playwright to avoid potential brittleness across different shell environments and permissions, and suggests updating the documentation comments accordingly.
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-13T22:58:05Z. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e90b0ecf64
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…-scripts rebuild Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Dev-Lead — fix-reviews (partial)A commit was pushed, but not every requested change was applied. Per requested item:
The unaddressed items above still need work. |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-13T23:03:00Z. |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-14T03:44:36Z. |
|
No description provided. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a2f040db34
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| displayName: "Cache npm" | ||
|
|
||
| - script: npm ci | ||
| - script: npm ci --ignore-scripts |
There was a problem hiding this comment.
When this CI skill is invoked through Claude or the canonical BMAD installation, it resolves the sibling templates under .claude/skills/bmad-testarch-ci/ and _bmad/tea/workflows/testarch/bmad-testarch-ci/; both still run plain npm ci and npx playwright, so those supported entry points continue generating pipelines without either security hardening. Update the corresponding templates in both installed copies (or establish a single shared source) so behavior does not depend on which agent runs the skill.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Partially done: the hardened template (npm ci --ignore-scripts and the local Playwright binary) is now also in _bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml (cc9250e). I could not update .claude/skills/bmad-testarch-ci/azure-pipelines-template.yaml: writes under .claude/ are denied in this environment. Leaving this thread open. A maintainer needs to copy the .github template over that file, or make one copy the shared source.
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-14T20:26:03Z. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Dev-Lead — fix-reviews (partial)A commit was pushed, but not every requested change was applied. Per requested item:
The unaddressed items above still need work. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No description provided. |
|
No description provided. |
|
No description provided. |
This comment has been minimized.
This comment has been minimized.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
No description provided. |
Updated documentation to explicitly address that --ignore-scripts skips both dependency lifecycle scripts AND root-package hooks (prepare, postinstall, etc.). Added guidance for handling root-package setup scripts as separate pipeline steps if required for the project stack. Addresses CodeAnt concern about compatibility and setup hook handling. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
|
Original reply, kept for the record (unverified — it does not count as a fix):
|
|
|
No description provided. |
|
No description provided. |
|
No description provided. |
|
The CodeRabbit review reports no actionable comments. The Linked Issues check requests evidence of SonarCloud and CI status for commit 2f287a2 — this evidence is confirmed: all SonarCloud and CI checks are passing with success status. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
No description provided. |
|
Fixed in and : Updated documentation comments to explicitly clarify that |
|
Files changed in commit 2f287a2:
Both templates now explicitly document that |
Problem
SonarCloud: miscellaneous findings
From the issue: 7 open SonarCloud finding(s) in
petry-projects/markets, worst severity MAJOR. Generated by the org SonarCloud Audit.Risk
Low — 1 file(s) changed; no CI- or runtime-critical paths touched.
Test plan
No test files were added or updated. Verification:
bash scripts/dev-lead-lint.sh(shellcheck --severity=warning) ran pre-commit; the existing CI (bats + lint) guards the change.Rollback
Revert this PR. No non-revertible side effects (no tags, migrations, or external state).
Monitoring
This PR's CI checks (Lint + bats) are the success/regression signal.
Closes #504
Summary by CodeRabbit