💚 fix(sonar): exclude generated + cluster/namespaced mirror from duplication gate - #40
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…ication gate
The SonarCloud quality gate failed on the sole condition
new_duplicated_lines_density (~22.9% vs <=3%). ~77% of the flagged
duplication is Upjet-generated zz_*.go and ~23% is the intentional
cluster/ <-> namespaced/ mirror of hand-written controllers and API types.
Add .sonarcloud.properties (the file Automatic Analysis actually reads;
sonar-project.properties is ignored):
- sonar.exclusions=**/zz_*.go (generated code, matches golangci generated:lax)
- sonar.cpd.exclusions for the mirrored controllers/types (CPD only; they
keep bug/security/reliability analysis)
Clears the gate without loosening the 3% threshold, so genuine future
duplication regressions still fail.
konih
force-pushed
the
fix/sonar-cpd-exclusions
branch
from
August 3, 2026 15:11
2d1ef18 to
20d713a
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
SonarCloud Quality Gate is failing on a single condition — every other condition passes (reliability A, security A, maintainability A, hotspots 100% reviewed):
new_duplicated_lines_densityThat's 5,002 duplicated lines across 55 files (measured via the SonarCloud API), and it splits cleanly into two by-design classes:
zz_*.go(dominated byzz_generated.resolvers.goandzz_generated.deepcopy.go). Machine-generated boilerplate, not ours to edit. Already treated as generated bygolangci-lint(generated: lax) and ignored by codecov.cluster/↔namespaced/mirror of hand-written observe controllers and API types (publicnetwork, backuplist). Dual-scope is a deliberate Crossplane-v2 architecture; the two trees are near-identical twins by construction.Neither is fixable by refactoring. SonarCloud runs as GitHub-App Automatic Analysis with no config in the repo, so it never got the same generated-code treatment the other quality tools already have.
Fix
Add
.sonarcloud.properties(the file Automatic Analysis actually reads —sonar-project.propertiesis silently ignored under Automatic Analysis):sonar.exclusionsdrops generated code from all analysis (mirrorsgolangci generated: lax/ codecovignore:).sonar.cpd.exclusionssuppresses the copy-paste flag on the mirrored hand-written files only — they still get bug/security/reliability analysis.The 3% threshold is not loosened, so genuine future duplication regressions still fail the gate.
Verification
SonarCloud Automatic Analysis re-runs on this PR; its check is the verification. Post-merge it re-runs on
mainand clears the project gate.