chore: add SonarCloud sync script + CI integration

.coderabbit.yaml

@@ -21,13 +21,5 @@ reviews:
     - "!**/dist/**"
     - "!**/.git/**"
 
-# Auto-review on PRs
-auto_review:
-  enabled: true
-  drafts: false
-  ignore_title_keywords:
-    - "WIP"
-    - "DRAFT"
-
 chat:
   auto_reply: true

.github/workflows/ci.yml

@@ -172,8 +172,9 @@ jobs:
   sonar:
     name: SonarCloud Scan
     runs-on: ubuntu-latest
-    continue-on-error: true  # Quality gate needs auth to fix
     if: github.event_name == 'push' || github.event_name == 'pull_request'
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
@@ -185,10 +186,30 @@ jobs:
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
       - name: SonarQube Scan
+        id: sonar-scan
+        continue-on-error: true
         uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
+  sonar-sync:
+    name: Sync SonarCloud findings
+    runs-on: ubuntu-latest
+    needs: sonar
+    if: github.event_name == 'push' && github.ref == 'refs/heads/develop' && needs.sonar.result == 'success'
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+      - name: Sync findings to GitHub Issues
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash scripts/sonarcloud-sync.sh
+
   dockerfile:
     name: Dockerfile Lint
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -87,33 +87,6 @@ jobs:
           # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
           # queries: security-extended,security-and-quality
 
-      # If the analyze step fails for one of the languages you are analyzing with
-      # "We were unable to automatically build your code", modify the matrix above
-      # to set the build mode to "manual" for that language. Then modify this step
-      # to build your code.
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-      - name: Setup Node.js
-        if: matrix.language == 'javascript-typescript' && matrix.build-mode == 'manual'
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
-        with:
-          node-version: 22
-
-      - name: Setup pnpm
-        if: matrix.language == 'javascript-typescript' && matrix.build-mode == 'manual'
-        shell: bash
-        run: corepack enable
-
-      - name: Install dependencies
-        if: matrix.language == 'javascript-typescript' && matrix.build-mode == 'manual'
-        shell: bash
-        run: pnpm install --frozen-lockfile --ignore-scripts
-
-      - name: Build project
-        if: matrix.language == 'javascript-typescript' && matrix.build-mode == 'manual'
-        shell: bash
-        run: pnpm run build
-
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@adfda868f108ac4222129de456ea554034a27db7 # v4
         with:

.github/workflows/osv-scanner.yml

@@ -34,6 +34,7 @@ jobs:
             -r
             --skip-git
             ./
+            --format=sarif
             --output=osv-scanner-results.sarif
 
       - name: Upload SARIF

AGENTS.md

@@ -114,7 +114,7 @@ For non-skill agents, treat the task map below as the local onboarding source: r
 | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
 | delete an "unused" export or file                                 | `fallow dead-code --trace <file>:<export>`                                           |
 | delete an "unused" dependency                                     | `fallow dead-code --trace-dependency <name>`                                         |
-| commit or open a PR                                               | `fallow audit --base <ref>`                                                          |
+| commit or open a PR                                               | `fallow audit --format json --quiet --explain --gate-marker agent`                   |
 | prioritize refactoring                                            | `fallow health --hotspots --targets`                                                 |
 | ask who owns code                                                 | `fallow health --ownership`                                                          |
 | check untested-but-reachable code                                 | `fallow health --coverage-gaps`                                                      |
@@ -184,9 +184,11 @@ gh issue list --repo BillyOutlast/drop --label sonarcloud --state open
 **SonarCloud project key**: `BillyOutlast_drop`. Use MCP sonarqube tools to query issues directly:
 
 ```text
-search_sonar_issues_in_projects(projects=["BillyOutlast_drop"], issueStatuses=["OPEN"])
+search_sonar_issues_in_projects(projects=["BillyOutlast_drop"], issueStatuses=["OPEN"], severities=["BLOCKER","CRITICAL","MAJOR"])
 ```
 
+This queries unresolved findings matching the sync script scope
+
 **Issue labels**: `sonarcloud`, `critical`, `major`, `minor`, `a11y`, `security`, `vue`, `react`, `readability`, `performance`, `code-quality`, `refactoring`
 
 **Working SonarCloud issues:**