Skip to content

fix: resolve security alerts and Sonar issues, prepare patch releases - #128

Merged
rodri-oliveira-dev merged 5 commits into
mainfrom
fix/security-website-lighthouse-dependencies
Oct 30, 2026
Merged

fix: resolve security alerts and Sonar issues, prepare patch releases#128
rodri-oliveira-dev merged 5 commits into
mainfrom
fix/security-website-lighthouse-dependencies

Conversation

@rodri-oliveira-dev

@rodri-oliveira-dev rodri-oliveira-dev commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

  • Replace the unmaintained LHCI dependency path with the official Lighthouse CLI 13.6.0, compatible with Node.js 24.
  • Preserve four representative URLs, three independent measurements per URL, median aggregation, score summaries, JSON artifacts, and the existing warning/blocking thresholds.
  • Add robust repository-owned validation and tests so missing, incomplete, invalid, or blocking results cannot pass silently.
  • Add weekly npm Dependabot coverage for the documentation portal without changing the existing NuGet, .NET SDK, GitHub Actions, or Roslyn compatibility policies.

Security fixes

All five alerts originate from website/package-lock.json and the @lhci/cli 0.15.1 dependency tree. Removing LHCI and regenerating the lockfile removes every affected package:

npm audit reports zero vulnerabilities, including development dependencies. npm ls extract-zip tmp uuid reports an empty tree.

Lighthouse migration

The workflow now invokes repository scripts backed by the official Lighthouse CLI. The collector clears stale output, runs each of the four configured routes three times, writes one JSON report per run, and fails immediately on CLI errors. The assertion script requires exactly three valid measurements for every route and category, calculates medians, writes the GitHub Actions summary, and enforces:

  • Performance: 85%, warning only.
  • Accessibility: 95%, blocking.
  • Best Practices: 95%, blocking.
  • SEO: 95%, blocking.

Missing report directories, absent reports, unexpected URLs, missing categories, non-numeric scores, incomplete run sets, and failed blocking gates all produce failures. The existing job/check name and always-uploaded report artifact are preserved.

Dependency automation

Dependabot now monitors npm dependencies in /website every Monday at 09:30 America/Sao_Paulo. Compatible minor and patch updates are grouped with the deps commit prefix; major updates remain separate for compatibility review. Existing NuGet, .NET SDK, GitHub Actions, and Roslyn constraints are unchanged.

SonarQube maintainability fixes

The seven requested csharpsquid:S3776 findings were refactored without suppressions or threshold changes:

Regression coverage was added for Big-O forms and comparison option contracts. Existing Analyzer characterization, CLI, MCP isolation/limits/cancellation/timeouts, package, compatibility, and performance coverage also passed. The five JavaScript findings previously reported on this PR were removed by simplifying the Lighthouse collector and summary code.

The final SonarQube Cloud analysis for this head passed its quality gate and reports zero open PR issues. The synchronized GitHub issues remain open for the normal merge/default-branch synchronization flow; they were not closed manually.

Release preparation

  • ComplexityAnalysis.Analyzers 1.6.1, intended tag v1.6.1.
  • ComplexityAnalysis.Tool 1.0.1, intended tag tool-v1.0.1.
  • ComplexityAnalysis.Mcp 1.0.1, intended tag mcp-v1.0.1.

All three versions were confirmed absent from NuGet.org and all three intended tags were confirmed absent locally and remotely. Package versioning remains independent. No target framework, Roslyn compatibility constraint, package publication, tag, Registry publication, GitHub Release, or merge was performed.

The Analyzer, Tool, and MCP manual workflow defaults now use the prepared versions. The MCP release notes were added in English and Brazilian Portuguese. The checked-in .mcp/server.json intentionally remains at the currently published Registry version 1.0.0; the protected MCP release workflow creates a versioned copy, validates equality with the package/tag, and updates the Official MCP Registry only after authorized NuGet publication.

Validation

Local validation from the repository root:

  • dotnet restore ./ComplexityAnalysis.Analyzers.slnx --source https://api.nuget.org/v3/index.json - passed. The canonical restore without an explicit source was blocked only by a stale machine-level NuGet source, which was not modified.
  • dotnet build ./ComplexityAnalysis.Analyzers.slnx --configuration Release --no-restore - passed with 0 errors.
  • dotnet test ./ComplexityAnalysis.Analyzers.slnx --configuration Release --no-build - passed, 1,300/1,300 tests.
  • Analyzer characterization - 51/51; performance budget contracts - 10/10; synthetic performance corpus - 9/9.
  • Analyzer package contracts - 5/5; consumer contract - 1/1; host compatibility contracts - 7/7.
  • Release packing produced ComplexityAnalysis.Analyzers.1.6.1.nupkg, ComplexityAnalysis.Tool.1.0.1.nupkg, and ComplexityAnalysis.Mcp.1.0.1.nupkg with the expected layouts and dependency metadata.
  • Isolated installs reported complexity-analysis 1.0.1 and complexity-mcp 1.0.1; the Analyzer assembly remained under analyzers/dotnet/cs/ with no lib/netstandard2.0/ copy.
  • npm audit - 0 vulnerabilities; npm ls extract-zip tmp uuid --all - empty.
  • Website unit tests - 12/12; Astro check - 0 diagnostics; build, route/link/SEO/HTML validation - passed for 70 routes; spelling - 81 files, 0 issues.
  • git diff --check - passed.

Remote validation on the final head:

  • SonarQube Cloud - quality gate OK, zero open PR issues.
  • Analyzer validation and pack, Tool/MCP/Analyzer release validation and pack, performance, .NET 8/9/10 compatibility, CodeQL, dependency review, portal, accessibility, SEO/HTML, and all 12 Lighthouse measurements - passed.
  • Publication, tag, Registry, release, and Pages deployment jobs were correctly skipped for the pull request.

Compatibility

The changes are patch-compatible: public APIs, analyzer diagnostic contracts and estimates, CLI arguments/exit behavior/JSON/SARIF formats, MCP tool schemas and response contracts, package layouts, target frameworks, and Roslyn constraints remain unchanged.

Remaining risks

The five Dependabot alerts remain visible on the default branch until merge; their dependency paths are absent on this branch according to npm audit and npm ls. The synchronized Sonar issues also remain open until the merge/default-branch analysis updates them. No release has been published, and the Official MCP Registry continues to advertise only the currently published version.

@coderabbitai

coderabbitai Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-30T00:20:44.810166Z 8fc102b Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

github-actions Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

SonarQube Cloud success

The SonarQube Cloud Quality Gate passed for this PR.

Quality Gate status: OK

Metric Status Actual Threshold
new_reliability_rating OK 1 1
new_security_rating OK 1 1
new_maintainability_rating OK 1 1
new_coverage OK 95.1 80
new_duplicated_lines_density OK 0.0 3
new_security_hotspots_reviewed OK 100.0 100

@rodri-oliveira-dev rodri-oliveira-dev changed the title fix(security): resolve npm vulnerabilities and modernize Lighthouse fix: resolve security alerts and Sonar issues, prepare patch releases Oct 30, 2026
@rodri-oliveira-dev

rodri-oliveira-dev commented Oct 30, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 30, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 8fc102b2a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@rodri-oliveira-dev
rodri-oliveira-dev merged commit 1ee863e into main Oct 30, 2026
43 checks passed
@rodri-oliveira-dev
rodri-oliveira-dev deleted the fix/security-website-lighthouse-dependencies branch October 30, 2026 00:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment