chore: add SonarQube golden path (MCP + pre-commit hook) - #10
Open
caroolcanelas2 wants to merge 3 commits into
Open
chore: add SonarQube golden path (MCP + pre-commit hook)#10caroolcanelas2 wants to merge 3 commits into
caroolcanelas2 wants to merge 3 commits into
Conversation
Wire a secrets-only Sonar gate into the existing Husky (v4, package.json config) pre-commit hook via scripts/sonar-verify-staged.sh / .ps1. The wrapper calls `sonar hook git-pre-commit` rather than the golden-path `sonar analyze --staged`, since the latter also triggers Vortex Agentic Analysis which returns 403 for orgs without that entitlement (VTEX included) and would block every commit. Code quality stays enforced by the full Sonar scan in CI.
Add a root .mcp.json for the sonarqube MCP server, with .cursor/mcp.json symlinked to it so Claude Code and Cursor share one config.
No Windows-specific caller wires this hook manager to PowerShell (only Husky.Net's task-runner.json windows block does that) — the .ps1 was dead code, never invoked.
|
0 New Issues
0 Fixed Issues
0 Accepted Issues
No data about coverage (0.00% Estimated after merge)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the purpose of this pull request?
Adopts the VTEX SonarQube golden path in this repository, in two parts:
1. SonarQube MCP (on-demand access from Claude Code / Cursor)
.mcp.jsonat the repo root with thesonarqubeserver (http://sonarqube.vtex.systems/mcp), read natively by Claude Code..cursor/mcp.jsonas a symlink →../.mcp.json, keeping a single source of truth for both editors.2. Secrets-only pre-commit hook (via Husky)
scripts/sonar-verify-staged.sh/.ps1— wrapper that resolves the Sonar CLI and runssonar hook git-pre-commit(secrets-only scan of staged files).package.json— this repo runs legacy Husky v4 (hook defined inline via thehusky.hooksfield, no.husky/directory). Rather than bundling an unrelated Husky major-version migration into this change, the sonar wrapper call was appended to the existingpre-commitstring alongsidelint-staged.AGENTS.md/CLAUDE.mdexists at the repo root yet, so no doc section was added.Based on the reference implementations: vtex/data-vault#99 (.NET wiring), vtex/admin-mercadolivre-monorepo#432 (MCP unification), vtex/seller-register-api#521 (secrets-only fix), and vtex/vbase#176 (this exact flow, first .NET repo it landed on).
What problem is this solving?
Standardizes local static analysis (pre-commit gate) and on-demand SonarQube access via MCP, per the VTEX golden path.
Note
About Vortex Agentic Analysis (403) — already worked around. The golden-path command
sonar analyze --stagedalso triggers server-side Vortex Agentic Analysis, which returns403 Forbiddenbecause most VTEX orgs don't yet have that entitlement (Sonar Agent Essentials). Since the CLI treats that as a failure (exit 1), it would block every commit. This PR wires the hook tosonar hook git-pre-commit(secrets-only) instead — no 403. Code quality stays enforced by the full Sonar scan in CI. The golden-path command is kept commented out in the wrapper scripts, ready to re-enable once the org has the entitlement.How should this be manually tested?
Validated locally: clean staged file → commit passes (no 403).
Types of changes
🤖 Generated with Claude Code