chore(ci): replace SonarCloud with ruff + Codecov - #1710
Merged
Conversation
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
MuncleUscles
changed the title
The quality gate measured the wrong diff. Dev branches were never branch-analysed, so PRs against them were scored against a stale main: the same 8-line fix passed on one base and failed on another. It was never a required check, and 9 of the last 60 merged PRs merged red. CodeQL and Semgrep already cover the security rules.
Backend coverage.xml had exactly one consumer, and removing SonarCloud left it unread. Codecov scores the real PR diff instead of a stale branch baseline, which is what the old gate got wrong.
Without synchronize, CodeQL only ran when a PR opened or reopened, so the first commit's result kept showing while later commits went unscanned.
Backend linting was black and autoflake only. Ruff catches three asyncio tasks created without a retained reference, which the event loop can garbage-collect mid-flight so a log publish silently never happens.
MuncleUscles
force-pushed
the
chore/remove-sonarcloud
branch
from
July 23, 2026 17:01
c79bb78 to
4747278
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits — the second is independent and can be dropped if you disagree with it.
Why remove it
The gate measured the wrong diff.
mainis the only branch SonarCloud has ever branch-analysed (last analysis 2026-06-17), so PRs targeting dev branches had no baseline and were scored against a stalemain. "New code" meant the entire dev-branch-vs-main divergence, not the PR.Proof — #1707 and #1708 are the same fix (identical title,
+8/−4, same two files), differing only in base branch:v0.121v0.123-dev#1706's report listed
fees.py(3,531 lines) andconsensus/base.py(782) — files it never touched.It never gated anything. Not a required check in any ruleset. 9 of the last 60 merged PRs merged with it red — 9 out of 9. It also silently didn't run at all on 16 PRs in May.
Nobody owned it. 0 of 65 security hotspots reviewed, ever. 791 open issues. The gate on
mainitself has been red indefinitely. Seven commits exist purely to appease it (bundling params into a dataclass for S107,# NOSONARon RFC1918 constants, three separate exclusion commits) against no verified defect it caused to be fixed.A red check that is wrong on every dev-branch PR trains everyone to ignore red checks — including E2E and CodeQL, which are load-bearing.
What covers the gap
--config auto, daily, SARIF) both already run. Sonar's security rules were the shallowest of the three, and contributed 2 BLOCKER-severity false positives from a stale FastAPI stub.coverage.xmlto Codecov. It had exactly one consumer — Sonar — so removing Sonar alone would have taken backend coverage dark. Codecov scores the real PR diff, which is precisely what the old gate got wrong.Not lost
Removing the CI integration stops new scans; it does not delete the SonarCloud project, so the existing 791 issues and 65 hotspots stay readable at sonarcloud.io for a one-off harvest. A sample found a few genuine bugs worth rescuing before the project is eventually deleted — notably two bare
asyncio.create_task()calls with no retained reference (redis_worker_handler.py:185,worker_handler.py:117), where the task can be GC'd mid-flight and silently drop a publish.Follow-ups (not in this PR)
ruffin pre-commit + CI — verified locally to catchRUF006on bothcreate_tasksites, i.e. the one category where Sonar produced real value. Backend Python linting is currently just black + autoflake.scan-codeql.ymltriggers onopened, ready_for_review, reopenedbut notsynchronize, so CodeQL does not rescan when commits are pushed to an open PR.