fix(sonarqube): resolve all quality gate failures introduced in PR #76 by Copilot · Pull Request #78 · abapify/adt-cli

Copilot · 2026-03-10T07:08:46Z

PR #76 (service-key auth plugin) failed the SonarQube quality gate with 10 Security Hotspots and 22.5% duplication on new code, plus 30+ code smell issues.

Security Hotspots (8 marked Safe)

All 8 encrypt-data hotspots were in auto-generated XSD schema files (aunitResult.ts, aunitRun.ts, adtcoreObjectSets.ts, atcexemption.ts). The flagged strings are XML namespace URI identifiers (e.g. http://www.sap.com/adt/core) — opaque string constants, not HTTP connections.

Duplication

Added sonar-project.properties excluding packages/*/src/schemas/generated/** from copy-paste detection. These files are codegen output with structurally identical patterns by design.

Code Smells

S7772 — Node.js built-in module prefix

// before
import { createServer } from 'http';
// after
import { createServer } from 'node:http';

Applied to service-key.ts, env.ts, aunit.ts, junit.ts.

S7781 / S7780 — replaceAll + String.raw

// before
return `'${json.slice(1, -1).replace(/\\"/g, '"').replace(/'/g, "\\'")}'`;
// after — extracted helper used in generate.ts and raw-schema.ts
function toSingleQuoteLiteral(jsonStr: string): string {
  return `'${jsonStr.slice(1, -1).replaceAll('\\"', '"').replaceAll("'", String.raw`\'`)}'`;
}

S4624 — Nested template literals
Extracted intermediate variables wherever an inner template was embedded in an outer one (e.g. authHeader in adapter.ts, OAuth error message in service-key.ts).

S3776 — Cognitive complexity
Reduced by extracting focused helpers:

aunit.ts: convertAlerts(), resolveTargets(), displayFailedMethod(), displaySummary()
junit.ts: buildTestCaseXml()
ts-morph.ts: resolveElementType(), findRefElement()

S2004 — Function nesting > 4 levels
In service-key.ts, the server.close(() => resolve(tokenData)) callback pattern was flattened to sequential calls inside the setTimeout body.

S7773 / S7778 — Misc
parseFloat → Number.parseFloat; consecutive Array#push() calls merged into one.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/1e6ff50f-723b-4089-b5f2-65b5b8586f2f
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx build adt-auth remo�� get-url origin rkflows.sh --noprofile -c /usr/bin/mkdir infocmp -1 REDACTED mkdir de/node/bin/bash tmp ripts/log-tool-c-c de/node/bin/bashhusky bash (http block)
https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/6f5798f5-33c9-4ed0-8e0a-fb254ebaae6f
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx lint adt-aunit ation/plugin-worker CHA20_POLY1305_S13714 sh i/node_modules/.bin/node node postinstallbash bash /usr/sbin/iptabl--noprofile ache/node/24.14.0/x64/bin/node 0/x6�� -1-219.876724.sock i/packages/ts-xsd/src/codegen/cli.ts i/node_modules/@esbuild/linux-x64/bin/esbuild i/packages/ts-xsbash security (http block)
https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/6f5798f5-33c9-4ed0-8e0a-fb254ebaae6f-logs
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx lint adt-aunit ation/plugin-worker CHA20_POLY1305_S13714 sh i/node_modules/.bin/node node postinstallbash bash /usr/sbin/iptabl--noprofile ache/node/24.14.0/x64/bin/node 0/x6�� -1-219.876724.sock i/packages/ts-xsd/src/codegen/cli.ts i/node_modules/@esbuild/linux-x64/bin/esbuild i/packages/ts-xsbash security (http block)
https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/7d4c72db-ebb1-48b9-96e1-153450d967a2-logs
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx build adt-client ts-xsd REDACTED infocmp h REDACTED bash nfig/composer/vepid bash --no�� --noprofile gh ndor/bin/bash /repos/abapify/aps --jq (http block)
https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/81031719-ee45-467f-85ba-d24f0286ee41
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx lint adt-auth -c che bash k/_temp/ghcca-node/node/bin/bash --noprofile -c (http block)
https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/81031719-ee45-467f-85ba-d24f0286ee41-logs
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx lint adt-auth -c che bash k/_temp/ghcca-node/node/bin/bash --noprofile -c (http block)
https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/82e18fd8-c46d-4135-9bb4-5c2edcb6c5af
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx lint ts-xsd ation/plugin-worker "tsdown" -nodes/project-json i/node_modules/@esbuild/linux-x64/bin/esbuild ts o.test.ts .ts i/node_modules/@-c test�� test.ts test.ts ult.test.ts --arg ts t.ts trip.test.ts tes--no-headers (http block)
https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/82e18fd8-c46d-4135-9bb4-5c2edcb6c5af-logs
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx lint ts-xsd ation/plugin-worker "tsdown" -nodes/project-json i/node_modules/@esbuild/linux-x64/bin/esbuild ts o.test.ts .ts i/node_modules/@-c test�� test.ts test.ts ult.test.ts --arg ts t.ts trip.test.ts tes--no-headers (http block)
https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/f93ef292-659c-4f8b-aca9-3c5e35fd149c
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx build adt-aunit --no�� uns?branch=copilot%2Ffix-sonarqube-findings&status=waiting -c ripts/log-tool-calls.sh s|.*github\.com[sh git alls.sh jq -c --arg ts de/node/bin/bash $ts} /sadc alls.sh bash (http block)
https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/fac86440-360f-47a0-a7ee-7e0c48e1d940
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx build adt-aunit --no�� uns?branch=copilot%2Ffix-sonarqube-findings&status=waiting -c ripts/log-tool-calls.sh s|.*github\.com[sh git alls.sh jq -c --arg ts de/node/bin/bash $ts} /sadc alls.sh bash (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

nx-cloud · 2026-03-10T07:19:36Z

View your CI Pipeline Execution ↗ for commit 9a12ee0

Command	Status	Duration	Result
`nx affected -t lint test build e2e-ci --verbose...`	✅ Succeeded	36s	View ↗

☁️ Nx Cloud last updated this comment at 2026-03-11 13:52:48 UTC

- Use node: prefix imports in service-key.ts, env.ts, aunit.ts, junit.ts - Fix nested template literals in service-key.ts, adapter.ts, aunit.ts, junit.ts - Replace String#replace() with String#replaceAll() in junit.ts, generate.ts, raw-schema.ts - Use String.raw for backslash escaping in generate.ts, raw-schema.ts - Replace parseFloat with Number.parseFloat in aunit.ts - Combine multiple Array#push() calls in junit.ts - Fix nested function depth (S2004) in service-key.ts - Reduce cognitive complexity in aunit.ts (extract convertAlerts, resolveTargets, displayFailedMethod, displaySummary) - Reduce cognitive complexity in junit.ts (extract buildTestCaseXml) - Reduce cognitive complexity in generate.ts and raw-schema.ts (extract toSingleQuoteLiteral) - Reduce cognitive complexity in ts-morph.ts (extract resolveElementType, findRefElement) - Mark 8 encrypt-data security hotspots in generated XSD schema files as Safe (XML namespace URIs) - Add sonar-project.properties to exclude generated schema files from duplication detection Co-authored-by: ThePlenkov <6381507+ThePlenkov@users.noreply.github.com>

sonarqubecloud · 2026-03-10T07:32:26Z

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
2.6% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

This PR addresses SonarQube quality gate failures introduced in PR #76 by reducing reported duplication on generated code and refactoring several TypeScript modules to satisfy code smell/security hotspot rules.

Changes:

Added sonar-project.properties to exclude generated schema output from Sonar CPD duplication checks.
Refactored string-literal generation and ts-morph codegen helpers to reduce complexity/duplication warnings.
Applied Node built-in module node: import prefixes and simplified nested template literal patterns across packages.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
sonar-project.properties	Excludes generated schema output from Sonar CPD duplication detection.
packages/ts-xsd/src/generators/raw-schema.ts	Extracts a helper for single-quote literal formatting to reduce smell findings.
packages/ts-xsd/src/codegen/generate.ts	Same single-quote literal helper extraction for codegen output formatting.
packages/ts-xsd/src/codegen/ts-morph.ts	Extracts helpers to reduce cognitive complexity and nesting.
packages/adt-client/src/adapter.ts	Flattens nested template literal usage when building Basic auth header.
packages/adt-auth/src/utils/env.ts	Switches built-in import to `node:fs` prefix.
packages/adt-auth/src/plugins/service-key.ts	Flattens nested template literal and callback nesting in PKCE flow.
packages/adt-aunit/src/formatters/junit.ts	Refactors JUnit XML generation to reduce complexity/nesting.
packages/adt-aunit/src/commands/aunit.ts	Extracts helpers to reduce cognitive complexity and nesting in AUnit command handling.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-11T14:25:21Z

packages/adt-auth/src/plugins/service-key.ts

+          server.close();
+          resolve(tokenData);


In the success path, server.close() is async; resolving the PKCE promise immediately after calling close() can leave the HTTP server keeping the event loop alive (or the port still bound) for a short period. Prefer resolving only once the close completes (e.g., wrap server.close(cb) in a Promise and await it inside the timeout) so the command can reliably terminate after auth.

Suggested change

server.close();

resolve(tokenData);

new Promise<void>((resolveClose, rejectClose) => {

server.close(err => (err ? rejectClose(err) : resolveClose()));

})

.then(() => resolve(tokenData))

.catch(reject);

Initial plan

a71f70c

Copilot AI assigned Copilot and ThePlenkov Mar 10, 2026

Copilot started work on behalf of ThePlenkov March 10, 2026 07:08 View session

Copilot AI changed the title ~~[WIP] Fix SonarQube findings in codebase~~ fix(sonarqube): resolve all quality gate failures introduced in PR #76 Mar 10, 2026

Copilot finished work on behalf of ThePlenkov March 10, 2026 07:35

ThePlenkov marked this pull request as ready for review March 11, 2026 14:17

Copilot AI review requested due to automatic review settings March 11, 2026 14:17

ThePlenkov merged commit 4f2d3f6 into main Mar 11, 2026
3 checks passed

ThePlenkov deleted the copilot/fix-sonarqube-findings branch March 11, 2026 14:17

Copilot started reviewing on behalf of ThePlenkov March 11, 2026 14:18 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(sonarqube): resolve all quality gate failures introduced in PR #76#78

fix(sonarqube): resolve all quality gate failures introduced in PR #76#78
ThePlenkov merged 2 commits intomainfrom
copilot/fix-sonarqube-findings

Copilot AI commented Mar 10, 2026 •

edited

Loading

Uh oh!

nx-cloud bot commented Mar 10, 2026 •

edited

Loading

Uh oh!

sonarqubecloud bot commented Mar 10, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-          server.close();
-          resolve(tokenData);
+          new Promise<void>((resolveClose, rejectClose) => {
+            server.close(err => (err ? rejectClose(err) : resolveClose()));
+          })
+            .then(() => resolve(tokenData))
+            .catch(reject);

Conversation

Copilot AI commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Hotspots (8 marked Safe)

Duplication

Code Smells

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

nx-cloud bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Mar 10, 2026

Quality Gate passed

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 10, 2026 •

edited

Loading

nx-cloud bot commented Mar 10, 2026 •

edited

Loading