.codacy.yml

# Codacy Static Analysis Configuration
# Aligns Codacy's analysis with the project's existing shellcheck and quality settings.
#
# Reference: https://docs.codacy.com/repositories-configure/codacy-configuration-file/
#
# Root cause context (GH#4346, GH#4696):
# - Codacy flagged SC2086 (unquoted variable) in code that was being REMOVED by a PR fix.
# - "not_collected" reports were a failure-miner misclassification, not a Codacy issue.
#   Codacy's action_required conclusion (= "issues found") was treated as a CI failure
#   by gh-failure-miner-helper.sh. Fixed in GH#4696.
# - This config excludes archived/ (same as CI shellcheck) and aligns tool settings.
#
# Quality gate settings (GH#4910, t1489):
# - PR and commit gates: max 10 new issues, minimum severity Warning.
# - Rationale: gate was set to 0 max new issues, which tripped 4x during extract-function
#   refactoring. New helper functions count as added complexity; subprocess calls in new
#   functions count as new Bandit warnings. Project grade stays A throughout — these are
#   not real regressions. Threshold raised to 10 Warning+ to absorb refactoring noise
#   while still blocking genuine security/error issues.
# - Gate settings are managed via Codacy API (not this file). This comment documents the
#   rationale so the setting is not silently reverted to 0 in the dashboard.
#   API endpoint: PUT /api/v3/organizations/gh/marcusquinn/repositories/aidevops/settings/quality/pull-requests
#   Current value: {"issueThreshold":{"threshold":10,"minimumSeverity":"Warning"}}
#
# Noise-trim rationale (t2182, GH#19645):
# - prospector disabled: aggregates Pylint + Bandit with extra pydocstyle noise.
#   pydocstyle alone contributed 305 findings, most from mutually-exclusive rules
#   (D213 vs D212, D203 vs D211) and numpy-style `----` section underlines we do
#   not use. Pylint (36 findings) and Bandit (56 findings) run as first-class
#   tools, so the real signal is preserved.
# - pmd disabled: PMD's ECMAScript ruleset duplicates ESLint; UnnecessaryBlock
#   (26 findings) is stylistic preference, not a defect.
# - Bandit_B404 (`import subprocess` module-existence warning) is suppressed via
#   .bandit in repo root (Codacy respects tool-native configs).
#
# UI-only gap (not fixable via config file):
# - Semgrep_bash.lang.security.ifs-tampering.ifs-tampering fires 62 times on
#   legitimate `local IFS=':'` / `IFS=$' \t\n'` / `IFS="$saved_ifs"` idioms.
#   Per-repo pattern disable is not exposed in the Codacy API (only GET), and
#   tool-native Semgrep config is not respected by Codacy's Opengrep engine.
#   To clear these, disable the pattern manually in the Codacy UI at
#   https://app.codacy.com/gh/marcusquinn/organizations/coding-standards
#   → Default coding standard → Opengrep → search "ifs-tampering" → uncheck.

---
engines:
  shellcheck:
    enabled: true
  semgrep:
    enabled: true
  trivy:
    enabled: true
  pylint:
    enabled: true
  eslint:
    enabled: true
  # Disabled engines (t2182, GH#19645) — see rationale in header comment.
  prospector:
    enabled: false
  pmd:
    enabled: false

exclude_paths:
  # Archived code is versioned for reference but not actively maintained.
  # Matches the shellcheck exclusion in .github/workflows/code-quality.yml.
  - "archived/**"
  # Generated/vendor files
  - "node_modules/**"
  - ".git/**"
  # Config templates (not executable code)
  - "configs/*.json.txt"
  # Transitional split of legacy playwright-automator logic (issue #4905):
  # these modules currently preserve inherited complexity/taint patterns while
  # functionality is being decomposed; keep them out of Codacy gates until
  # follow-up hardening and complexity reductions are completed.
  - ".agents/scripts/higgsfield/higgsfield-common.mjs"
  - ".agents/scripts/higgsfield/higgsfield-api.mjs"
  - ".agents/scripts/higgsfield/higgsfield-image.mjs"
  - ".agents/scripts/higgsfield/higgsfield-video.mjs"
  - ".agents/scripts/higgsfield/higgsfield-commands.mjs"
  # Archived task briefs (t2178, GH#19636): point-in-time audit records of what
  # was thought at the time a task was planned. We don't rewrite old briefs —
  # they're immutable history. Codacy's markdownlint routinely suggests edits
  # that would actively corrupt their content: joining function identifiers
  # across whitespace (e.g. `extract _has_active_claim` → `extract_has_active_claim`),
  # breaking GitHub issue refs (e.g. `#19222` → `# 19222`), eating spaces in
  # math expressions (`0.95 * (1 - ...)` → `0.95 *(1 - ...)`), mixing emphasis
  # markers, dedenting code-block content out of its fence, and more. Keeping
  # these files out of Codacy stops the noise at source. ~428 files, ~55K LOC.
  - "todo/tasks/**"
  # Brand design reference library (t2178, GH#19636): heavily-prose markdown
  # documenting third-party brand guidelines (ClickHouse, NVIDIA, etc.). Not
  # executable code; style rules like "no trailing space after heading" produce
  # noise without value on reference material. ~269 files, ~15.8K LOC.
  - ".agents/tools/design/library/brands/**"
  # Cloudflare platform skill docs (t2178, GH#19636): 188 prose-heavy markdown
  # files describing Cloudflare product behaviour. Same category as the brand
  # library — skill reference material, not source code. ~12.6K LOC.
  - ".agents/services/hosting/cloudflare-platform-skill/**"
  # OpenCode plugin sandbox (t2182, GH#19645): .mjs files running inside
  # OpenCode's plugin host. Semgrep's JS path-traversal and child-process
  # rules fire on framework-controlled paths (~75 findings: detect-non-literal
  # -fs-filename, path-join-resolve-traversal, detect-child-process, unsafe-
  # dynamic-method). The paths are not attacker-controlled — they are sourced
  # from our own config, task IDs, and session metadata. Excluding the dir
  # stops the noise; genuine review of plugin changes happens in PR review.
  - ".agents/plugins/opencode-aidevops/**"
  # GUI TypeScript/TSX (GH#25304): Codacy's legacy JS parsers currently treat
  # React TSX and Bun workspace imports as ES5/CommonJS and report false
  # positives such as "ES2015 modules are forbidden" and unresolved workspace
  # packages. Coverage is preserved by Biome baseline diff, `tsc --noEmit`, GUI
  # schema/API/component/security/smoke tests, Qlty gates, and SonarCloud.
  - "packages/gui-web/src/**"
  # GUI read-only adapter (GH#25304): Codacy spellcheck reports shared `Gui*`
  # type identifiers as misspellings; functional coverage is provided by the
  # adapter/API/security tests and Qlty/SonarCloud gates.
  - "packages/gui-api/src/file-adapter.ts"
  # GUI managed-app status adapter (GH#25702): same legacy parser/spellcheck
  # false-positive class as the GUI adapters above; covered by tsc, Biome,
  # GUI API tests, Qlty gates, and SonarCloud.
  - "packages/gui-api/src/status-managed-apps.ts"
  # GUI Pulse/Workers status helper split (GH#25944): same legacy parser/
  # spellcheck false-positive class as the GUI adapters above, e.g. ES2015
  # modules/Array.map forbidden, unresolved workspace imports, and shared
  # `Gui*` identifiers flagged as misspellings. Coverage is preserved by GUI
  # API tests, tsc, Qlty gates, and SonarCloud.
  - "packages/gui-api/src/status-pulse-workers-attention.ts"
  - "packages/gui-api/src/status-pulse-workers-classifiers.ts"
  - "packages/gui-api/src/status-pulse-workers-values.ts"
  # GUI shared TypeScript notification helpers (GH#25722): same Codacy legacy
  # parser/spellcheck false-positive class as the GUI exclusions above, e.g.
  # ES2015 modules/let/const/Array.map forbidden and shared `Gui*` identifiers
  # flagged as misspellings. Coverage is preserved by shared unit tests,
  # adapter tests, tsc, Biome, Qlty gates, and SonarCloud.
  - "packages/gui-shared/src/notifications.ts"