SonarCloud: miscellaneous findings

[don-petry]

SonarCloud: miscellaneous findings

1 open SonarCloud finding(s) in petry-projects/google-app-scripts, worst severity INFO. Generated by the org SonarCloud Audit.

View in SonarCloud →

Findings

Rule	Count	Representative message
githubactions:S1135	1	Complete the task associated to this "TODO" comment.

Affected files

• .github/workflows/pr-auto-review.yml (1)

Priority

Labeled priority:info — mapped from this bucket's worst SonarCloud severity (INFO).

Acceptance

• All findings in this workstream resolved to zero in SonarCloud
• No behavior change; CI green
• Real fixes (no blanket NOSONAR unless a confirmed false positive, noted inline)

---

Idempotent issue — updated automatically each audit run; auto-closed when the finding count reaches zero.

[don-petry]

SonarCloud Audit (2026-09-01): still open — 1 finding(s), worst severity INFO.

[don-petry]

Dev-Lead Implementation Plan

Issue: #558 — SonarCloud: miscellaneous findings

Scope

Resolve the single SonarCloud githubactions:S1135 finding (INFO) by completing the TODO comment on line 31 of .github/workflows/pr-auto-review.yml.

Analysis

• The finding is: "Complete the task associated to this 'TODO' comment."
• The TODO reads: # TODO: replace "CI" with your repository's CI workflow name(s).
• This repo's CI workflow is named CI (.github/workflows/ci.yml → name: CI), so the current value workflows: ["CI"] is already correct for this repository.
• The stub header explicitly permits changing workflow_run.workflows to match the repo's CI workflow name(s); the pinned reusable uses: line and permissions:/trigger blocks are left untouched (no with: forwarding across the channel pin).

Implementation Checklist

• Replace the TODO comment with a resolved, non-TODO comment documenting that "CI" is this repo's CI workflow name — value unchanged, removing the S1135 token.

Tests to Write

• None — pure configuration/comment change with no observable behavior change (Phase 2 exception per dev-lead instructions). No test harness validates this workflow YAML.

Test Command

npm test (run for full-suite regression safety), plus bash .dev-lead/scripts/dev-lead-lint.sh and npm run check.

[don-petry]

Dev-Lead: Progress (in progress — not yet durable)

Provisional. Nothing is pushed yet; the automation posts the authoritative
completion record (with PR number + head SHA) after the push. Treat the notes
below as intent, not delivered results.

Plan Execution (intended)

• Resolved SonarCloud githubactions:S1135 on .github/workflows/pr-auto-review.yml line 31 by completing the TODO: this repo's CI workflow is named CI (.github/workflows/ci.yml), so workflows: ["CI"] is already correct. Replaced the # TODO: ... comment with a resolved, non-TODO comment documenting that fact.
• Left the pinned reusable uses: ...@pr-auto-review/v1-stable, permissions:, and trigger event types untouched; no with: forward added across the channel pin.

Local check output (provisional — not the pushed run)

Test Suites: 15 passed, 15 total
Tests:       404 passed, 404 total
dev-lead-lint: all checks passed
npm run check: 0 errors (22 pre-existing warnings in unrelated test files)

Files touched (this workspace, not yet pushed)

• .github/workflows/pr-auto-review.yml: replaced the TODO comment with a resolved comment; value unchanged (no behavior change).

Notes

Pure configuration/comment change — no observable behavior change, so Phase 2 (test-first) was skipped per the documented exception; no test harness validates this workflow YAML.

[don-petry]

Dev-Lead: Implementation Complete — PR #564

The implementation for issue #558 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.

• Pull request: feat: implement issue #558 — SonarCloud: miscellaneous findings #564
• Head commit: 392ecd21c4a82f3def607c0b9d52f96fe3f1f243
• Run: https://github.com/petry-projects/google-app-scripts/actions/runs/33552520690

Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.