Skip to content

feat: implement issue #504 — SonarCloud: miscellaneous findings #526

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
don-petry merged 10 commits into from
Oct 16, 2026
Merged

feat: implement issue #504 — SonarCloud: miscellaneous findings #526

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
e90b0ec
feat: implement issue #504 — SonarCloud: miscellaneous findings
don-petry Oct 13, 2026
3afdb18
fix(reviews): use npx --no-install for Playwright and document ignore…
don-petry Oct 13, 2026
6bb03d5
Merge branch 'main' into dev-lead/issue-504-20261013-2154
don-petry Oct 14, 2026
a2f040d
Merge branch 'main' into dev-lead/issue-504-20261013-2154
don-petry Oct 14, 2026
cc9250e
fix(reviews): use local playwright binary; sync hardened azure templa…
don-petry Oct 14, 2026
47bca97
Merge branch 'main' into dev-lead/issue-504-20261013-2154
don-petry Oct 14, 2026
401c3bc
Merge branch 'main' into dev-lead/issue-504-20261013-2154
don-petry Oct 14, 2026
8a02835
Merge branch 'main' into dev-lead/issue-504-20261013-2154
don-petry Oct 14, 2026
69c5c35
Merge branch 'main' into dev-lead/issue-504-20261013-2154
don-petry Oct 15, 2026
2f287a2
fix(bot): clarify --ignore-scripts behavior for root-package hooks
don-petry Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 14 additions & 7 deletions .github/skills/bmad-testarch-ci/azure-pipelines-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,17 @@
# Stack: {test_stack_type} | Framework: {test_framework}
#
# Variables to customize per project:
# INSTALL_CMD - dependency install command (e.g., npm ci, pnpm install --frozen-lockfile)
# INSTALL_CMD - dependency install command (e.g., npm ci --ignore-scripts, pnpm install --frozen-lockfile --ignore-scripts)
# NOTE: --ignore-scripts skips ALL lifecycle scripts — both dependency scripts (preinstall/postinstall/prepare)
# AND root-package hooks (SonarCloud S6505). For dependencies needing lifecycle scripts, add explicit
# `npm rebuild <pkg>` steps. For root-package scripts (e.g., prepare hooks), run them as separate steps
# (e.g., `npm run prepare` if needed for your stack).
# TEST_CMD - main test command (e.g., npm run test:e2e, npm test, npx vitest)
# LINT_CMD - lint command (e.g., npm run lint)
# BROWSER_INSTALL - browser install command (frontend/fullstack only; omit for backend)
# BROWSER_INSTALL - browser install command using the lockfile-pinned local binary; avoid npx,
# which can resolve an unpinned copy from the npx cache or global bin
# (e.g., ./node_modules/.bin/playwright install --with-deps chromium;
# frontend/fullstack only; omit for backend)
# DEFAULT_NODE_VERSION - Node.js version (read from .nvmrc or default to 24)

trigger:
Expand Down Expand Up @@ -51,7 +58,7 @@ stages:
path: $(npm_config_cache)
displayName: "Cache npm"

- script: npm ci
- script: npm ci --ignore-scripts
Comment thread
don-petry marked this conversation as resolved.

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Apply the hardening to every installed skill copy

When this CI skill is invoked through Claude or the canonical BMAD installation, it resolves the sibling templates under .claude/skills/bmad-testarch-ci/ and _bmad/tea/workflows/testarch/bmad-testarch-ci/; both still run plain npm ci and npx playwright, so those supported entry points continue generating pipelines without either security hardening. Update the corresponding templates in both installed copies (or establish a single shared source) so behavior does not depend on which agent runs the skill.

Useful? React with 👍 / 👎.

@don-petry don-petry Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Partially done: the hardened template (npm ci --ignore-scripts and the local Playwright binary) is now also in _bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml (cc9250e). I could not update .claude/skills/bmad-testarch-ci/azure-pipelines-template.yaml: writes under .claude/ are denied in this environment. Leaving this thread open. A maintainer needs to copy the .github template over that file, or make one copy the shared source.

displayName: "Install dependencies" # Replace with INSTALL_CMD

- script: npm run lint
Expand Down Expand Up @@ -90,11 +97,11 @@ stages:
path: $(npm_config_cache)
displayName: "Cache npm"

- script: npm ci
- script: npm ci --ignore-scripts
displayName: "Install dependencies" # Replace with INSTALL_CMD

# Frontend/Fullstack only — skipped for backend-only stacks
- script: npx playwright install --with-deps chromium
- script: ./node_modules/.bin/playwright install --with-deps chromium
condition: ne(variables['TEST_STACK_TYPE'], 'backend')
displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL

Expand Down Expand Up @@ -132,11 +139,11 @@ stages:
versionSpec: $(DEFAULT_NODE_VERSION)
displayName: "Setup Node.js"

- script: npm ci
- script: npm ci --ignore-scripts
displayName: "Install dependencies" # Replace with INSTALL_CMD

# Frontend/Fullstack only — skipped for backend-only stacks
- script: npx playwright install --with-deps chromium
- script: ./node_modules/.bin/playwright install --with-deps chromium
condition: ne(variables['TEST_STACK_TYPE'], 'backend')
displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL

Expand Down
21 changes: 14 additions & 7 deletions _bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,17 @@
# Stack: {test_stack_type} | Framework: {test_framework}
#
# Variables to customize per project:
# INSTALL_CMD - dependency install command (e.g., npm ci, pnpm install --frozen-lockfile)
# INSTALL_CMD - dependency install command (e.g., npm ci --ignore-scripts, pnpm install --frozen-lockfile --ignore-scripts)
# NOTE: --ignore-scripts skips ALL lifecycle scripts — both dependency scripts (preinstall/postinstall/prepare)
# AND root-package hooks (SonarCloud S6505). For dependencies needing lifecycle scripts, add explicit
# `npm rebuild <pkg>` steps. For root-package scripts (e.g., prepare hooks), run them as separate steps
# (e.g., `npm run prepare` if needed for your stack).
# TEST_CMD - main test command (e.g., npm run test:e2e, npm test, npx vitest)
# LINT_CMD - lint command (e.g., npm run lint)
# BROWSER_INSTALL - browser install command (frontend/fullstack only; omit for backend)
# BROWSER_INSTALL - browser install command using the lockfile-pinned local binary; avoid npx,
# which can resolve an unpinned copy from the npx cache or global bin
# (e.g., ./node_modules/.bin/playwright install --with-deps chromium;
# frontend/fullstack only; omit for backend)
# DEFAULT_NODE_VERSION - Node.js version (read from .nvmrc or default to 24)

trigger:
Expand Down Expand Up @@ -51,7 +58,7 @@ stages:
path: $(npm_config_cache)
displayName: "Cache npm"

- script: npm ci
- script: npm ci --ignore-scripts
displayName: "Install dependencies" # Replace with INSTALL_CMD

- script: npm run lint
Expand Down Expand Up @@ -90,11 +97,11 @@ stages:
path: $(npm_config_cache)
displayName: "Cache npm"

- script: npm ci
- script: npm ci --ignore-scripts
displayName: "Install dependencies" # Replace with INSTALL_CMD

# Frontend/Fullstack only — skipped for backend-only stacks
- script: npx playwright install --with-deps chromium
- script: ./node_modules/.bin/playwright install --with-deps chromium
condition: ne(variables['TEST_STACK_TYPE'], 'backend')
displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL

Expand Down Expand Up @@ -132,11 +139,11 @@ stages:
versionSpec: $(DEFAULT_NODE_VERSION)
displayName: "Setup Node.js"

- script: npm ci
- script: npm ci --ignore-scripts
displayName: "Install dependencies" # Replace with INSTALL_CMD

# Frontend/Fullstack only — skipped for backend-only stacks
- script: npx playwright install --with-deps chromium
- script: ./node_modules/.bin/playwright install --with-deps chromium
condition: ne(variables['TEST_STACK_TYPE'], 'backend')
displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL

Expand Down
Loading