Repository navigation
Release alpha to master: SonarCloud gate fixes and local store hardening - #376
Open
prashantasdeveloper wants to merge 7 commits into
Open
prashantasdeveloper wants to merge 7 commits into
prashantasdeveloper wants to merge 7 commits into
Conversation
Addresses every open issue the quality gate reported on master. Security (New Code rating C -> A): - disable dependency lifecycle scripts on CI installs with `yarn --immutable --mode=skip-build`, running the repo's own trusted postinstall as an explicit step so the @PolkaDot dedupe still happens - pin sequoia-pgp/fast-forward to a full commit SHA (v1.0.0), clearing the outstanding security hotspot Code smells: - mark never-reassigned members readonly - prefer node: protocol imports, Number.isNaN / Number.parseInt, Date.now() and Array.prototype.flatMap over lodash flatten - avoid an object literal as a default parameter in ApiArrayResponse - use String.raw for the regex literals in jest.config.js - sort the Dockerfile apk packages, use `[[ ]]` in the shell scripts and give the integration-test cleanup trap an explicit return - extract cloneRepo/buildAndPushImage out of the Jenkinsfile node block to keep control flow nesting within 3 levels Tests: - complete the vacuous assertion in the batchBumpNonce spec, which called expect() with no matcher and so asserted nothing S2187 is ignored for the datastore repo specs: they delegate to shared suites (`XRepo.test(repo)`) whose `it` blocks Sonar's static analysis cannot see, making "add some tests to this file" a false positive.
The Jenkins pipeline is no longer used, so drop it along with the CODEOWNERS entry that pointed at it. This also removes the three S134 control flow nesting smells the previous commit refactored the file to satisfy.
`./github` is syntactically valid but never matches, so changes under `.github/` were silently falling through to the catch-all owners rather than requiring SRE review. Use a root-anchored `/.github/` instead. Also replace the individually named catch-all owners with the Middleware team. Three of the four no longer resolve, which left a single valid reviewer on every path.
Lookups in the local API key store and local signer address book now only match entries that were explicitly configured or added.
Contributor
|
🎉 This PR is included in version 9.0.1-alpha.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
F-OBrien
previously approved these changes
Sep 28, 2026
|
/fast-forward |
Contributor
|
Triggered from #376 (comment) by @F-OBrien. Trying to fast forward Target branch ( commit 0a240901b9a6889b77a55c78676a76087621e569 (HEAD -> master, tag: v9.0.0, origin/master)
Author: Prashant Bajpai <34747455+prashantasdeveloper@users.noreply.github.com>
Date: Fri Sep 18 15:46:14 2026 +0530
refactor: 💡 resolve SonarCloud issues
Mark the PortfoliosController logger as readonly and extract the duplicated
Identity setup in the registerIdentity/registerDid controller specs into a
shared helper.Pull request ( commit 6be80684417663a76a7948bd0da22b44d719a770 (pull_request/alpha)
Author: Prashant Bajpai <34747455+prashantasdeveloper@users.noreply.github.com>
Date: Mon Sep 28 12:55:26 2026 +0530
fix: 🐛 use null-prototype maps in local API key and signer stores
Lookups in the local API key store and local signer address book now
only match entries that were explicitly configured or added.Fast forwarding $ git push origin 6be80684417663a76a7948bd0da22b44d719a770:master
remote: error: GH006: Protected branch update failed for refs/heads/master.
remote:
remote: - Waiting on code owner review from PolymeshAssociation/sre.
To https://github.com/PolymeshAssociation/polymesh-rest-api.git
! [remote rejected] 6be80684417663a76a7948bd0da22b44d719a770 -> master (protected branch hook declined)
error: failed to push some refs to 'https://github.com/PolymeshAssociation/polymesh-rest-api.git' |
debelio
previously approved these changes
Sep 29, 2026
The global logging interceptor wrote every request body to the logs in plaintext, including the signer mnemonic sent to `POST /signer` and the API key sent to `POST /auth/api-key/delete`. Anyone with read access to the service logs could recover them. Body fields whose names contain mnemonic, apiKey, secret, privateKey, password, passphrase or seed now log as `*REDACTED*`, at any depth, for the request log and for the 4xx and 5xx response logs.
A mnemonic the keyring cannot parse surfaced as an unhandled error and a 500 response. It is now rejected as a validation error with a 400, and the underlying error is dropped so the mnemonic is never echoed back.
Contributor
|
🎉 This PR is included in version 9.0.1-alpha.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Reliability: - await the offline transaction status update, which was fire and forget, so a failed write no longer goes unnoticed as an unhandled rejection - log a clear error when an offline service cannot register its message listener, instead of leaving the rejection unhandled - exit with a non zero code when the swagger spec cannot be written Code smells: - drop `async` from methods with no `await` in the local signer and API key stores and `PolymeshService.execTransaction`, returning settled promises so errors are still delivered as rejections
1 of 4 tasks
|
Contributor
|
🎉 This PR is included in version 9.0.1-alpha.3 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JIRA Link
N/A
Changelog / Description
Releases the four commits on
alphathat are not yet onmaster, from #374 and #375.6be8068is afix:, so merging cuts a patch release.fix: use null-prototype maps in local API key and signer stores(fix: 🐛 use null-prototype maps in local API key and signer stores #375)LocalApiKeysRepo.apiKeysandLocalSigningService.addressBookare now created withObject.create(null), so lookups only match entries that were explicitly configured or added.chore: resolve SonarCloud quality gate failures(chore: 🤖 resolve SonarCloud quality gate failures #374)yarn --immutable --mode=skip-buildso dependency lifecycle scripts don't execute, followed by an explicityarn run postinstallso the repo's own@polkadotdedupe still runs. Same change inscripts/integration-test.sh.sequoia-pgp/fast-forwardpinned to a full commit SHA (v1.0.0, same commit as before).readonlymembers,node:imports,Number.isNaN/Number.parseInt,Date.now(),flatMapover lodashflatten,String.rawregexes injest.config.js, and shell/Dockerfile tidy-ups.batchBumpNoncespec calledexpect()with no matcher, so it never asserted anything. It now checks the delegation toincrementNonces.S2187is suppressed for the*.repo.spec.tsfiles insonar-project.properties. They run shared suites Sonar can't see, so the finding is a false positive.chore: remove the unused Jenkinsfilechore: correct the CODEOWNERS patterns and owners./githubnever matched anything, so.github/changes fell through to the catch-all owners. It is now the root-anchored/.github/, which requires SRE review.@PolymeshAssociation/middleware. Three of the four named owners no longer resolved.Reviewer notes
mastergoes green after merge. The project uses Automatic Analysis, so check that thesonar.issue.ignore.multicriteriasuppression is honoured. If the 9S2187findings still show, mark them "Won't Fix" in the SonarCloud UI./fast-forwardsomasterandalphastay identical.Checklist -
🤖 Generated with Claude Code