Problem
PR #163 was force-merged because SonarCloud Code Analysis quality gate failed on new_coverage: 0.0% for scripts/check-new-vulns.cjs (a new ~230-line file with no tests). To unblock the merge, both rulesets (keep summer safe on rebuild, develop protection on develop) had SonarCloud Scan + Sync SonarCloud findings removed from required_status_checks. The rulesets have been restored, so future PRs will once again be blocked on SonarCloud.
Root Cause
scripts/check-new-vulns.cjs is pure CLI tooling (entry point that runs as a Node subprocess in CI) and exposes no exported module API. It's structurally similar to scripts/codecov-pr-comment.sh, scripts/sonarcloud-sync.sh, and scripts/sonarcloud-pr-comment.sh — bash scripts that SonarCloud does NOT scan for coverage (no sonar.tests= entry picks them up).
Options
Option A — Add vitest unit tests for check-new-vulns.cjs
Refactor the script to export its functions (parseArgs, readJson, readKnownAdvisories, severityRank, extractPnpm, extractCargo, main) so vitest can import them. Add scripts/check-new-vulns.test.js covering:
parseArgs valid args, missing values, flag-as-value, --helpreadJson missing/empty/invalid filesreadKnownAdvisories missing/empty/inline-comment register entriesseverityRank all known levels + unknown/nullextractPnpm and extractCargo happy paths + malformed entriesmain exit code matrix (NEW vuln, KNOWN vuln, missing inputs)
Configure sonar.tests=scripts/ in sonar-project.properties so SonarCloud counts these.
Effort: ~1-2 hours. Testable locally via node --test or vitest run scripts/.
Option B — Add SonarCloud coverage exclusion
In sonar-project.properties:
sonar.coverage.exclusions=scripts/check-new-vulns.cjs,scripts/codecov-pr-comment.sh,scripts/sonarcloud-sync.sh,scripts/sonarcloud-pr-comment.sh
This explicitly tells SonarCloud to skip these files for coverage accounting. The other CI scripts are already implicit exclusions (no .test.* next to them) but explicit is cleaner.
Effort: ~5 minutes. Zero behavior change.
Option C — Lower SonarCloud new-code coverage threshold
Edit the SonarCloud quality gate to require ≥ 0% (or just disable the new_coverage condition entirely). This affects ALL future PRs globally — risky.
Effort: ~2 minutes. NOT RECOMMENDED — defeats the purpose of the gate.
Suggested Decision
Option B is the pragmatic short-term fix (5 min, unblocks PRs immediately, zero risk). Option A is the right long-term fix (testable, maintains quality bar). Recommend doing B now + scheduling A as a follow-up to add test coverage that exercises the script's edge cases (which is itself useful regression protection).
Acceptance Criteria
Verification
After the fix:
# Trigger a CI run that touches scripts/ to confirm SonarCloud quality gate passes
gh pr create --base develop --head test/sonar-coverage-fix
Provenance
Discovered during PR #163 force-merge on 2026-07-27. The SonarCloud quality gate failure on 0.0% coverage on new code was the actual blocker (the rubber-stamping was already unblocked by the previous fix). Required admin override + temporary ruleset relaxation to merge.
Problem
PR #163 was force-merged because
SonarCloud Code Analysisquality gate failed onnew_coverage: 0.0%forscripts/check-new-vulns.cjs(a new ~230-line file with no tests). To unblock the merge, both rulesets (keep summer safeon rebuild,develop protectionon develop) hadSonarCloud Scan+Sync SonarCloud findingsremoved fromrequired_status_checks. The rulesets have been restored, so future PRs will once again be blocked on SonarCloud.Root Cause
scripts/check-new-vulns.cjsis pure CLI tooling (entry point that runs as a Node subprocess in CI) and exposes no exported module API. It's structurally similar toscripts/codecov-pr-comment.sh,scripts/sonarcloud-sync.sh, andscripts/sonarcloud-pr-comment.sh— bash scripts that SonarCloud does NOT scan for coverage (nosonar.tests=entry picks them up).Options
Option A — Add vitest unit tests for
check-new-vulns.cjsRefactor the script to export its functions (
parseArgs,readJson,readKnownAdvisories,severityRank,extractPnpm,extractCargo,main) so vitest can import them. Addscripts/check-new-vulns.test.jscovering:parseArgsvalid args, missing values, flag-as-value,--helpreadJsonmissing/empty/invalid filesreadKnownAdvisoriesmissing/empty/inline-comment register entriesseverityRankall known levels + unknown/nullextractPnpmandextractCargohappy paths + malformed entriesmainexit code matrix (NEW vuln, KNOWN vuln, missing inputs)Configure
sonar.tests=scripts/insonar-project.propertiesso SonarCloud counts these.Effort: ~1-2 hours. Testable locally via
node --testorvitest run scripts/.Option B — Add SonarCloud coverage exclusion
In
sonar-project.properties:This explicitly tells SonarCloud to skip these files for coverage accounting. The other CI scripts are already implicit exclusions (no
.test.*next to them) but explicit is cleaner.Effort: ~5 minutes. Zero behavior change.
Option C — Lower SonarCloud new-code coverage threshold
Edit the SonarCloud quality gate to require ≥ 0% (or just disable the new_coverage condition entirely). This affects ALL future PRs globally — risky.
Effort: ~2 minutes. NOT RECOMMENDED — defeats the purpose of the gate.
Suggested Decision
Option B is the pragmatic short-term fix (5 min, unblocks PRs immediately, zero risk). Option A is the right long-term fix (testable, maintains quality bar). Recommend doing B now + scheduling A as a follow-up to add test coverage that exercises the script's edge cases (which is itself useful regression protection).
Acceptance Criteria
sonar.coverage.exclusionsincludesscripts/check-new-vulns.cjs(Option B) OR vitest unit tests added with ≥80% line coverage (Option A)scripts/--adminbypass needed)Verification
After the fix:
# Trigger a CI run that touches scripts/ to confirm SonarCloud quality gate passes gh pr create --base develop --head test/sonar-coverage-fixProvenance
Discovered during PR #163 force-merge on 2026-07-27. The SonarCloud quality gate failure on
0.0% coverage on new codewas the actual blocker (the rubber-stamping was already unblocked by the previous fix). Required admin override + temporary ruleset relaxation to merge.