# Project-specific half of the SonarQube analysis. The workflow is the shared
# block in workflow-util/pipelines and is identical for every repository that
# uses it; everything that is about THIS repository lives here.
#
# The key carries the owner. The instance serves two owners (jlab-cluster and
# suer), so a bare "helm-charts" would be free now and collide the moment the
# second owner has a repository of the same name - and a key cannot be changed
# afterwards without losing the project's history.
sonar.projectKey=jlab-cluster_helm-charts
sonar.projectName=jlab-cluster/helm-charts

# The whole tree, which is also the scanner's default - stated rather than
# implied, because the absence of exclusions below is a decision and an empty
# file would not show that.
sonar.sources=.

# NO EXCLUSIONS, deliberately, for the first round.
#
# The interesting case is the Helm templates: because of {{ }} they are not
# valid YAML, and what the Helm and YAML analysers do with them is something we
# can only find out by letting them run over them once. Excluding them up front
# would throw away the only chance to learn it, and it would exclude the 26
# chart template directories that are the bulk of this repository.
#
# The same goes for the secret detection, which is the most valuable analyser
# here: the premise of this repository is that no credential ever lands in it -
# every secret is a 1Password OnePasswordItem reference - and until now nothing
# checked that premise.
#
# If the first run produces noise that is genuinely not worth reading, the
# exclusions belong here, with the finding they answer named in a comment. Not
# before: an exclusion written on a guess hides whatever else matched it.