Repository navigation
Conversation
The minified esbuild output in src/SyncFactors.Api/wwwroot/dist is committed build output (vendored SignalR and friends). Every rebuild makes the whole one-line bundle count as new code, so third-party findings in it fail the SonarCloud gate on new-code security rating. The sources under frontend/ are still analyzed. Also fix the release workflow's required-check verification, which filtered jobs with $job instead of $_ and could never match. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKFiDhryKSzpEeY7FnFSbT
The policy check pinned the old $job.id/$job.name filter, which never matched any job. Require the $_ form instead. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKFiDhryKSzpEeY7FnFSbT
Owner
Author
|
The Generated by Claude Code |
0Downtime
marked this pull request as ready for review
October 12, 2026 17:00
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Chris · project thread
Summary
mainhas failed on C Security Rating on New Code. The last pass was on99390a2(Jul 18) and the first failure ondb99a0e(Jul 25).src/SyncFactors.Api/wwwroot/dist/dashboard.js. That file is 700 KB of minified esbuild output, including vendored SignalR, on a single line. Any rebuild makes the whole line count as new code, so findings in third-party code end up gatingmain. The sources underfrontend/are still analyzed, so excluding the generatedwwwroot/dist/**keeps coverage of our own code.release.yml's "Verify required CI checks" filtered jobs with$job.id/$job.nameinstead of$_. It could never match a job, so releases would always wait out the 30-minute deadline and then fail.Validation
mainafter merge (PR analysis only gates the PR's own diff)The SonarCloud API is blocked from the environment that made this change, so I couldn't read the exact issue. The bundle is the strongest candidate from the diff, but it is inferred. If
mainstill fails after merge, the issue list on SonarCloud names the file.Risk Notes
src/SyncFactors.Api/wwwroot/dist/**🤖 Generated with Claude Code
https://claude.ai/code/session_01FKFiDhryKSzpEeY7FnFSbT
Generated by Claude Code