chore(ci): scope Sonar and Codacy off the generated skill bundles

[amondnet]

Refs #19. Fixes the half of that issue a commit can fix, and reports what is left.

What was actually wrong

Neither service runs from a workflow — both analyse every push through their GitHub App, with no configuration in the repository. So skills/spring-docs/scripts/docs.mjs was scored as ordinary source. It is scripts/docs.ts put through the bundler and committed, because the npx skills install channel copies only the skill directory and runs no dependency install.

Analysing it reports the same program twice:

Failed condition	Cause
Duplication on New Code 7.7% (gate ≤ 3%)	the bundle against its own source
Reliability Rating C on New Code (gate ≥ A)	Unexpected var ×2, emitted by Bun at docs.mjs:162,234

Neither is editable: bun run build:skill:check byte-compares the committed bundle against a fresh build, so hand-editing it fails CI. eslint.config.js already ignored the directory for exactly this reason — the two analysers now do the same.

The file names are not interchangeable

Verified against the vendor docs rather than assumed, because the obvious guess is wrong in both cases:

• SonarQube Cloud is in Automatic Analysis mode, which reads .sonarcloud.properties and "will ignore the parameters in your sonar-project.properties file". It also allows no wildcards, honours only the copy on the default branch, and overrides the UI where the two disagree.
• Codacy reads .codacy.yml, first line ---. Additions are honoured on the PR that makes them; only removals wait for the default branch. Once the file exists, the UI's "Ignored files" settings stop applying.

Validated locally:

$ docker run --rm -v "$(pwd)":/src codacy/codacy-analysis-cli validate-configuration --directory /src
Successfully loaded the Codacy configuration file in /src/.codacy.yml
CodacyConfigurationFile(None, Some(Set(Glob("skills/*/scripts/**"))), None)

What to expect on this PR

• Codacy should improve here. Its additions apply to the PR being analysed.
• SonarCloud will not. Its file only counts on the default branch, so this PR is still analysed under the old scope. Verify on main's next analysis after merge.

What this does not fix

Codacy's ESLint runs its own rule set, not this repository's. That is why bun run lint is clean while Codacy reports 35 findings of Found <fn> from package "node:fs" with non literal argument — the rule is detect-non-literal-fs-filename from eslint-plugin-security v4, which is not in this repository's dependency tree at all. On a module whose entire job is building and reading cache paths, it fires on nearly every line, including the tests.

Codacy does detect eslint.config.js for ESLint v9, but turning it on is a toggle on the repository's Code patterns page — a UI action, not something a commit can do. Doing so would make Codacy enforce the same rules CI already enforces, instead of a different set nobody reads.

One correction to #19

#19 says the gates' authority is unclear. It is not: the main ruleset carries no required_status_checks rule. Its pull_request rule is required_approving_review_count: 0, allowed_merge_methods: ["squash"], required_review_thread_resolution: true.

So Sonar and Codacy have never blocked a merge. A PR reading mergeStateStatus: BLOCKED on green CI is an unresolved review thread — which is exactly what happened on #17, where the merge went through the moment the last thread was resolved. Separately, auto-merge cannot be armed at all because the repository sets allow_auto_merge: false.

That makes this change a noise fix rather than an unblocking one, which is the honest framing: a check that is permanently red teaches people to ignore checks.

Remaining manual steps

1. Codacy → repository → Code patterns → ESLint v9 → activate Configuration file. Worth verifying afterwards that Codacy can actually load eslint.config.js, since it resolves @pleaseai/eslint-config from node_modules.
2. Decide whether allow_auto_merge should stay off.

Both are recorded in .please/docs/knowledge/gotchas.md along with the file-name and default-branch semantics, so the next person does not re-derive them.

---

Summary by cubic

Excludes the generated skill bundles from SonarCloud and Codacy analysis so the committed bundle is no longer scored as ordinary source, fixing the duplicate-finding half of #19.

Notes

• SonarCloud reads .sonarcloud.properties on the default branch only, so this PR's analysis is still under the old scope; the exclusion takes effect after merge.
• Codacy reads .codacy.yml and honors additions on the PR that makes them.
• Codacy's ESLint still runs its own rule set rather than this repo's; that's documented in gotchas, not fixed here.
• Neither check blocks a merge, so this is noise reduction, not an unblock.

^{Written for commit 768e65c. Summary will update on new commits.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[gemini-code-assist]

Code Review

This pull request introduces configuration files for Codacy and SonarQube Cloud to exclude generated skill bundles from static analysis, alongside updating the documentation to explain these integrations. The review feedback suggests utilizing wildcard patterns for SonarCloud exclusions rather than hardcoding specific paths, correcting the assumption that wildcards are unsupported in Automatic Analysis mode.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with both exclusions aligned to the repository’s current generated bundle layout.

Summary

• Adds Codacy exclusions for generated scripts across skill directories.
• Adds Sonar exclusions for the current generated bundle directory.
• Records analyzer configuration semantics and remaining manual Codacy setup.

_{Reviews (1) · Last reviewed commit: "chore(ci): scope Sonar and Codacy off th..."}

[cubic-dev-ai]

No issues found across 3 files

Architecture diagram

sequenceDiagram
    participant SOURCE as Source Repo
    participant GHA as GitHub Actions (CI)
    participant SONAR as SonarQube Cloud
    participant CODACY as Codacy
    participant BUNDLER as Bundler (Bun)
    participant SKILLS as Skills Check

    Note over SOURCE,BUNDLER: Source code (TypeScript)
    SOURCE->>BUNDLER: bun run build:skill
    BUNDLER->>BUNDLER: Compile to JS bundle
    BUNDLER->>SOURCE: Commit generated .mjs bundle

    Note over SOURCE,GHA: Repository Actions
    SOURCE->>GHA: Push event
    GHA->>SKILLS: bun run build:skill:check
    SKILLS->>SOURCE: Byte-compare fresh build vs committed
    SKILLS-->>GHA: Verify identical (fail on difference)

    Note over GHA,SONAR: External Analysis (GitHub App-triggered)
    SOURCE->>SONAR: Push event (App webhook)
    
    alt Automatic Analysis mode
        SONAR->>SONAR: Read .sonarcloud.properties (default branch only)
        Note over SONAR: Excludes skills/*/scripts/ path
        SONAR->>SOURCE: Analyze source files (skip excluded)
        SONAR-->>SOURCE: Quality report (no duplication)
    end

    SOURCE->>CODACY: Push event (App webhook)
    
    alt Codacy analysis
        CODACY->>SONAR: Validate .codacy.yml
        Note over CODACY: First line ---, valid YAML
        CODACY->>CODACY: Read exclude_paths glob
        CODACY->>SOURCE: Analyze source (skip skills/*/scripts/**)
        CODACY-->>SOURCE: Quality report (clean)
    end

    Note over CODACY: ESLint rule set issue
    opt Codacy ESLint (own rule set)
        CODACY->>CODACY: Run eslint-plugin-security rules
        Note over CODACY: Non-literal filename rule fires on bundle
        CODACY-->>SOURCE: False positives (not from repo deps)
    end

    Note over GHA,SONAR: PR state consideration
    SOURCE->>GHA: PR status checks
    GHA-->>SONAR: Report checks (no required status)
    GHA-->>CODACY: Report checks (no required status)
    Note over SONAR,CODACY: Neither workflow invokes analysis
    Note over SONAR,CODACY: Pure GitHub App push-triggered

Loading

_{Re-trigger cubic}