fix: resolve all SonarQube code quality issues and security hotspots#11
Merged
Conversation
- Replace pip install uv with astral-sh/setup-uv action (pinned SHA) - Add --frozen to uv sync to enforce lockfile usage - Add --no-build to uv sync and uv run to prevent setup script execution - Add --no-sync to uv run to skip implicit re-sync - Pin SonarSource/sonarqube-scan-action to full commit SHA
Quick wins (16 rule types): - S5713: remove redundant exception handlers (codebase_map, metadata_extractor) - S1481: remove unused variables (codebase_map, metadata_extractor) - S1172: remove unused params from code_graph functions - S8572: use logging.exception instead of logging.error (codebase_map) - S108: remove empty TYPE_CHECKING block (metadata_extractor) - S1940: use != instead of not == (ingestion) - S3626: remove redundant continue (retrieval) - S7500: use dict() constructor (reranker) - S1066: merge if with elif (cli) - S5754: remove try/except swallowing SystemExit (cli) - S1192: extract duplicated string literal to constant (cli) - S2583: remove always-true condition (code_graph) - S3516: simplify always-returns-False function (sparse_retriever) - S7503: remove async from function without await (ingestion) - S1871: merge identical branches (doc_graph) - S3457: remove f-prefix from strings without fields (cli) Cognitive complexity refactoring (S3776, 7 functions): - cli.py: extract helpers from ingest (CC 33), benchmark (CC 20), delete (CC 30) - doc_graph.py: extract helpers from compute_metadata_edges (CC 17), compute_heading_edges (CC 24), build_document_graph (CC 20), compute_cross_links (CC 55) Security hotspots (S5852, 6 regex patterns): - All reviewed and marked SAFE — operate on trusted/short inputs with bounded patterns
…ssues - Add [tool.pyright] section scoping analysis to src/ and tests/ - Exclude experiments/, .venv/, __pycache__/, .opencode/ from Pyright - Fix tar.extractfile() None guard in prepare_dataset.py - Refactor high cognitive complexity functions in prepare_dataset.py - Extract duplicated filename literals to constants
Fixes Node.js 20 deprecation warning from GitHub Actions runners.
Pins all third-party actions to SHA-pinned versions running Node.js 24.
The --no-build flag prevents building source distributions, but the project's own editable install (rag-mcp @ editable+.) requires a build step. --frozen already ensures the lockfile is used as-is, so all dependencies are locked and reproducible.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes all open SonarQube issues and security hotspots across the codebase.
Changes
CI/CD hardening (
ci.yml)pip install uvwith pinnedastral-sh/setup-uvaction (SHA-pinned)--frozentouv sync,--no-syncand--no-buildtouv runSonarSource/sonarqube-scan-actionto full commit SHACode quality fixes (S-rule issues)
cli.py)logging.exceptioninstead oflogging.errorwithexc_infoSecurity hotspots (S5852)
Tooling
[tool.pyright]config topyproject.tomlscoping analysis tosrc/andtests/tar.extractfile()None guard inprepare_dataset.pyTesting
uv run pytest -m 'not slow' -v)