chore: 🤖 resolve SonarCloud quality gate failures

.github/CODEOWNERS

@@ -1,3 +1,2 @@
-*    @VictorVicente @polymath-eric @prashantasdeveloper @sansan
-Jenkinsfile    @PolymeshAssociation/SRE
-./github  @PolymeshAssociation/SRE
+*    @PolymeshAssociation/middleware
+/.github/  @PolymeshAssociation/SRE

.github/workflows/fast-forward.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Fast forwarding
-        uses: sequoia-pgp/fast-forward@v1
+        uses: sequoia-pgp/fast-forward@ea7628bedcb0b0b96e94383ada458d812fca4979 # v1.0.0
         with:
           merge: true
           # To reduce the workflow's verbosity, use 'on-error'

.github/workflows/integration-test.yml

@@ -17,6 +17,9 @@ jobs:
           cache: 'yarn'
           cache-dependency-path: 'yarn.lock'
       - name: install dependencies
-        run: yarn --immutable
+        # dependency lifecycle scripts are disabled to avoid executing untrusted code
+        run: yarn --immutable --mode=skip-build
+      - name: run trusted postinstall
+        run: yarn run postinstall
       - name: test
         run: yarn test:integration

.github/workflows/main.yml

@@ -30,7 +30,10 @@ jobs:
           node-version: '22.x'
           cache: 'yarn'
       - name: install dependencies
-        run: yarn --immutable
+        # dependency lifecycle scripts are disabled to avoid executing untrusted code
+        run: yarn --immutable --mode=skip-build
+      - name: run trusted postinstall
+        run: yarn run postinstall
       - name: lint
         run: yarn lint
 
@@ -50,7 +53,10 @@ jobs:
           node-version: '22.x'
           cache: 'yarn'
       - name: install dependencies
-        run: yarn --immutable
+        # dependency lifecycle scripts are disabled to avoid executing untrusted code
+        run: yarn --immutable --mode=skip-build
+      - name: run trusted postinstall
+        run: yarn run postinstall
       - name: build
         run: yarn build
 
@@ -70,7 +76,10 @@ jobs:
           node-version: '22.x'
           cache: 'yarn'
       - name: install dependencies
-        run: yarn --immutable
+        # dependency lifecycle scripts are disabled to avoid executing untrusted code
+        run: yarn --immutable --mode=skip-build
+      - name: run trusted postinstall
+        run: yarn run postinstall
       - name: test
         run: yarn test:cov
 
@@ -91,7 +100,10 @@ jobs:
           node-version: '22.x'
           cache: 'yarn'
       - name: install dependencies
-        run: yarn --immutable
+        # dependency lifecycle scripts are disabled to avoid executing untrusted code
+        run: yarn --immutable --mode=skip-build
+      - name: run trusted postinstall
+        run: yarn run postinstall
       # - name: integration test
       #   run: yarn test:integration
       - name: Setup SSH signing key
@@ -138,7 +150,7 @@ jobs:
 
     steps:
       - name: Checking if fast forwarding is possible
-        uses: sequoia-pgp/fast-forward@v1
+        uses: sequoia-pgp/fast-forward@ea7628bedcb0b0b96e94383ada458d812fca4979 # v1.0.0
         with:
           merge: false
           # To reduce the workflow's verbosity, use 'on-error'

Dockerfile

@@ -1,11 +1,11 @@
 FROM node:lts-alpine3.17 AS builder
 
 RUN apk add --no-cache \
-    python3 \
-    make \
     cmake \
     g++ \
-    jq
+    jq \
+    make \
+    python3
 
 WORKDIR /app/builder
 RUN chown -R node: /app

jest.config.js

@@ -1,13 +1,13 @@
 module.exports = {
   preset: 'ts-jest/presets/js-with-babel',
-  transformIgnorePatterns: ['/node_modules/(?![@polymeshassociation/src]).+\\.js$'],
+  transformIgnorePatterns: [String.raw`/node_modules/(?![@polymeshassociation/src]).+\.js$`],
   testEnvironment: 'node',
   moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json', 'node'],
   testPathIgnorePatterns: ['<rootDir>/dist/*'],
   moduleNameMapper: {
     '~/(.*)': '<rootDir>/src/$1',
   },
-  testRegex: '.*\\.spec\\.ts$',
+  testRegex: String.raw`.*\.spec\.ts$`,
   coverageDirectory: './coverage',
   collectCoverage: true,
   restoreMocks: true,

prepareRelease.sh

@@ -10,7 +10,7 @@ CHAIN_TAG='8.0.0-testnet-debian'
 # This lets it work on arm64, like Mac Books
 ARCHITECTURE=$(uname -m)
 CHAIN_REPO=polymeshassociation/polymesh
-if [ "$ARCHITECTURE" = "arm64" ]; then
+if [[ "$ARCHITECTURE" == "arm64" ]]; then
     CHAIN_REPO="polymeshassociation/polymesh-arm64"
 fi
 

scripts/integration-test.sh

@@ -9,7 +9,8 @@ git clone https://github.com/PolymeshAssociation/polymesh-dev-env.git "$DEV_ENV_
 
 pushd "$INTEGRATION_DIR"
 
-yarn
+# lifecycle scripts are disabled to avoid executing untrusted dependency code
+yarn --mode=skip-build
 echo "starting up environment"
 yarn test:start
 echo "env is set up"
@@ -24,14 +25,16 @@ export POLYMESH_MIDDLEWARE_V2_URL="http://localhost:3000"
 # register cleanup to stop the background service
 function cleanup() {
     echo "cleaning up test environment"
-    if [ -n "${SERVICE_PID}" ]; then
+    if [[ -n "${SERVICE_PID}" ]]; then
         echo "Cleaning up service with PID: ${SERVICE_PID}"
         kill "${SERVICE_PID}"
     fi
 
     yarn test:stop
 
-    rm -rf $DEV_ENV_DIR
+    rm -rf "$DEV_ENV_DIR"
+
+    return 0
 }
 trap cleanup EXIT INT TERM
 

sonar-project.properties

@@ -0,0 +1,10 @@
+sonar.projectKey=PolymeshAssociation_polymesh-rest-api
+sonar.organization=polymeshassociation
+
+# The datastore repo specs delegate to a shared, reusable suite that each implementation
+# must pass (e.g. `NotificationRepo.test(repo)`). The `it(...)` blocks live in the
+# `*.repo.suite.ts` helpers, so Sonar's static analysis cannot see them and wrongly reports
+# S2187 ("Add some tests to this file or delete it"). These files do run real tests.
+sonar.issue.ignore.multicriteria=e1
+sonar.issue.ignore.multicriteria.e1.ruleKey=typescript:S2187
+sonar.issue.ignore.multicriteria.e1.resourceKey=src/datastore/**/repos/*.repo.spec.ts

src/claims/decorators/get-custom-claim-type.pipe.ts

@@ -17,5 +17,5 @@ export class GetCustomClaimTypePipe implements PipeTransform {
 }
 
 function isNumericString(value: string): boolean {
-  return !isNaN(Number(value));
+  return !Number.isNaN(Number(value));
 }

src/commands/write-swagger.ts

@@ -1,6 +1,7 @@
+import { writeFileSync } from 'node:fs';
+
 import { NestFactory } from '@nestjs/core';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
-import { writeFileSync } from 'fs';
 
 import { AppModule } from '~/app.module';
 import { swaggerDescription, swaggerTitle } from '~/common/utils';

src/common/decorators/swagger.ts

@@ -23,18 +23,16 @@ import { ResultsModel } from '~/common/models/results.model';
 export const ApiArrayResponse = <TModel extends Type | string>(
   model: TModel,
   {
-    paginated,
+    paginated = true,
     example,
     examples,
     description,
   }: {
-    paginated: boolean;
+    paginated?: boolean;
     example?: unknown;
     examples?: unknown[] | Record<string, unknown>;
     description?: string;
-  } = {
-    paginated: true,
-  }
+  } = {}
 ): ReturnType<typeof applyDecorators> => {
   const extraModels = [];
   let items;

src/common/utils/functions.ts

@@ -6,7 +6,6 @@ import {
   TxTags,
 } from '@polymeshassociation/polymesh-sdk/types';
 import { randomBytes } from 'crypto';
-import { flatten } from 'lodash';
 import { promisify } from 'util';
 
 import { TransactionBaseDto } from '~/common/dto/transaction-base-dto';
@@ -28,7 +27,7 @@ import {
 import { ResultType } from '~/transactions/types';
 
 export function getTxTags(): string[] {
-  return flatten(Object.values(TxTags).map(txTag => Object.values(txTag)));
+  return Object.values(TxTags).flatMap(txTag => Object.values(txTag));
 }
 
 export function getTxTagsWithModuleNames(): string[] {

src/corporate-actions/decorators/validation.ts

@@ -15,7 +15,7 @@ export function IsCaCheckpoint() {
       validator: {
         async validate(value: unknown) {
           if (value instanceof Date) {
-            return !isNaN(new Date(value).getTime());
+            return !Number.isNaN(new Date(value).getTime());
           }
           if (value instanceof CorporateActionCheckpointDto) {
             return (await validateClass(value)).length === 0;

src/datastore/postgres/repos/api-keys.repo.ts

@@ -11,7 +11,7 @@ import { UserModel } from '~/users/model/user.model';
 
 @Injectable()
 export class PostgresApiKeyRepo implements ApiKeyRepo {
-  constructor(@InjectRepository(ApiKey) private apiKeyRepo: Repository<ApiKey>) {}
+  constructor(@InjectRepository(ApiKey) private readonly apiKeyRepo: Repository<ApiKey>) {}
 
   public async createApiKey(user: UserModel): Promise<ApiKeyModel> {
     const secret = await generateBase64Secret(32);

src/datastore/postgres/repos/notification.repo.ts

@@ -11,7 +11,10 @@ import { NotificationParams } from '~/notifications/types';
 
 @Injectable()
 export class PostgresNotificationRepo implements NotificationRepo {
-  constructor(@InjectRepository(Notification) private notificationRepo: Repository<Notification>) {}
+  constructor(
+    @InjectRepository(Notification)
+    private readonly notificationRepo: Repository<Notification>
+  ) {}
 
   public async create(params: NotificationParams): Promise<NotificationModel> {
     const entity = this.notificationRepo.create({

src/datastore/postgres/repos/subscription.repo.ts

@@ -11,7 +11,10 @@ import { SubscriptionParams } from '~/subscriptions/types';
 
 @Injectable()
 export class PostgresSubscriptionRepo implements SubscriptionRepo {
-  constructor(@InjectRepository(Subscription) private subscriptionRepo: Repository<Subscription>) {}
+  constructor(
+    @InjectRepository(Subscription)
+    private readonly subscriptionRepo: Repository<Subscription>
+  ) {}
 
   public async create(params: SubscriptionParams): Promise<SubscriptionModel> {
     const entity = this.subscriptionRepo.create({

src/datastore/postgres/source.ts

@@ -1,7 +1,8 @@
 /* istanbul ignore file */
 
+import path from 'node:path';
+
 import * as dotenv from 'dotenv';
-import path from 'path';
 import { DataSource } from 'typeorm';
 
 import { readPostgresConfigFromEnv } from '~/datastore/postgres/utils';

src/identities/dto/register-identity.dto.ts

@@ -39,7 +39,7 @@ export class RegisterIdentityDto extends TransactionBaseDto {
   @ApiPropertyOptional({
     description:
       'Date at which the Identity will expire. Deprecated: as of chain v8 this no longer has any on-chain effect',
-    example: new Date(new Date().getTime() + +365 * 24 * 60 * 60 * 1000).toISOString(),
+    example: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString(),
     type: 'string',
     deprecated: true,
   })

src/message/artemis/artemis.service.ts

@@ -30,8 +30,8 @@ type AddressStore = Record<AddressName, AddressEntry>;
 
 @Injectable()
 export class ArtemisService extends MessageService implements OnApplicationShutdown {
-  private receivers: Receiver[] = [];
-  private addressStore: Partial<AddressStore> = {};
+  private readonly receivers: Receiver[] = [];
+  private readonly addressStore: Partial<AddressStore> = {};
   private connectionPromise?: Promise<Connection>;
 
   constructor(

src/notifications/notifications.service.ts

@@ -19,8 +19,8 @@ import { SubscriptionsService } from '~/subscriptions/subscriptions.service';
 
 @Injectable()
 export class NotificationsService {
-  private maxTries: number;
-  private retryInterval: number;
+  private readonly maxTries: number;
+  private readonly retryInterval: number;
 
   constructor(
     @Inject(notificationsConfig.KEY) config: ConfigType<typeof notificationsConfig>,