chore: add SonarQube golden path (MCP + pre-commit hook)

.cursor/mcp.json

@@ -0,0 +1 @@
+../.mcp.json

.gitignore

@@ -43,4 +43,5 @@ package-lock.json
 yarn-error.log
 
 # AI IDE
-.cursor/
+.cursor/*
+!.cursor/mcp.json

.husky/pre-commit

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+bash scripts/sonar-verify-staged.sh

.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "sonarqube": {
+      "type": "http",
+      "url": "http://sonarqube.vtex.systems/mcp"
+    }
+  }
+}

package.json

@@ -20,7 +20,8 @@
     "prepublishOnly": "bash ./scripts/publishLock.sh",
     "ci:build": "yarn build && yarn gen",
     "ci:test": "yarn test --ci --coverage",
-    "ci:prettier-check": "prettier --check --config ./.prettierrc \"src/**/*.ts\" \"src/**/*.js\""
+    "ci:prettier-check": "prettier --check --config ./.prettierrc \"src/**/*.ts\" \"src/**/*.js\"",
+    "prepare": "husky"
   },
   "jest": {
     "transform": {
@@ -118,6 +119,7 @@
     "@types/semver": "^5.5.0",
     "@types/uuid": "^3.4.6",
     "get-port": "^5.1.1",
+    "husky": "^9.1.7",
     "jest": "^25.1.0",
     "npm-run-all": "^4.1.3",
     "rimraf": "^2.5.2",

scripts/sonar-verify-staged.ps1

@@ -0,0 +1,26 @@
+# Sonar pre-commit gate for staged files (Windows-safe path resolution).
+#
+# Runs a secrets-only scan (`sonar hook git-pre-commit`). The golden-path command
+# `sonar analyze --staged` also triggers Agentic Analysis, which currently returns
+# 403 for the VTEX org (feature not enabled yet), so it is kept commented out below.
+# Code quality is still enforced by the full Sonar scan in CI.
+$ErrorActionPreference = "Stop"
+
+$sonarInPath = Get-Command sonar -ErrorAction SilentlyContinue
+if ($sonarInPath) {
+    $sonarExe = $sonarInPath.Source
+} else {
+    $sonarExe = Join-Path $env:LOCALAPPDATA "sonarqube-cli\bin\sonar.exe"
+    if (-not (Test-Path $sonarExe)) {
+        Write-Host "Sonar CLI not found. Install with:" -ForegroundColor Red
+        Write-Host "  Windows: irm https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.ps1 | iex" -ForegroundColor Red
+        Write-Host "  macOS/Linux: curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh | bash" -ForegroundColor Red
+        Write-Host "  Docs: https://darkkitchen.vtex.com/docs/default/domain/engineering/engineering-golden-path/qa-static-analysis/" -ForegroundColor Red
+        exit 1
+    }
+}
+
+# Golden path (re-enable when Agentic Analysis is available for the org):
+# & $sonarExe analyze --staged --project vtex_goldenpath
+& $sonarExe hook git-pre-commit
+exit $LASTEXITCODE

scripts/sonar-verify-staged.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Sonar pre-commit gate for staged files (macOS/Linux).
+#
+# Runs a secrets-only scan (`sonar hook git-pre-commit`). The golden-path command
+# `sonar analyze --staged` also triggers Agentic Analysis, which currently returns
+# 403 for the VTEX org (feature not enabled yet), so it is kept commented out below.
+# Code quality is still enforced by the full Sonar scan in CI.
+set -euo pipefail
+
+if command -v sonar >/dev/null 2>&1; then
+  SONAR_CMD="$(command -v sonar)"
+elif [[ -x "${HOME}/.local/share/sonarqube-cli/bin/sonar" ]]; then
+  SONAR_CMD="${HOME}/.local/share/sonarqube-cli/bin/sonar"
+else
+  echo "Sonar CLI not found. Install with:" >&2
+  echo "  curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh | bash" >&2
+  exit 1
+fi
+
+# Golden path (re-enable when Agentic Analysis is available for the org):
+# exec "$SONAR_CMD" analyze --staged --project vtex_goldenpath
+exec "$SONAR_CMD" hook git-pre-commit

yarn.lock

@@ -2993,6 +2993,11 @@ humanize-ms@^1.2.1:
   dependencies:
     ms "^2.0.0"
 
+husky@^9.1.7:
+  version "9.1.7"
+  resolved "https://registry.yarnpkg.com/husky/-/husky-9.1.7.tgz#d46a38035d101b46a70456a850ff4201344c0b2d"
+  integrity sha512-5gs5ytaNjBrh5Ow3zrvdUUY+0VxIuWVL4i9irt6friV+BqdCfmV11CQTWMiBYWHbXhco+J1kHfTOUkePhCDvMA==
+
 iconv-lite@0.4.24:
   version "0.4.24"
   resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.4.24.tgz#2022b4b25fbddc21d2f524974a474aafe733908b"