fix: SonarCloud findings on main, 123 fixed and 41 refuted

Merged
HA
6d ago
+136-380

Summary

SonarCloud lists 164 open issues on main (issues); this fixes 123 and refutes 41.

Changes

Backend: BaseEvent revalidates its dataclass fields. The cancel route drops a reason body nothing stored since #428, and the spec and client are regenerated. 45 routes drop a response_model equal to their return annotation, and the spec stays byte-identical. The queue registers its Lua scripts once, six needless async methods become plain, unused parameters and two getattr calls go.

Frontend: the editor CSS loses !important copies of its CodeMirror theme, plus small TypeScript cleanups.

Docs: Material draws Mermaid in a closed shadow root, so the 30 overrides never applied (diagrams pixel-identical). extra.css never loaded in the Swagger iframes, so the filter box now hides through extra_css.

Not changed: 26 duplicated literals are span names, MongoDB operators and log event names; 7 functions are async for Starlette, APScheduler or an awaited dispatch table; 4 !important are the reduced-motion reset; 2 nestings are Tailwind's @utility; the email regex is linear (1.7 MB in 46 ms); RedactingFilter.filter returns True by contract.

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update
  • Refactoring (no functional changes)
  • CI/CD or tooling changes

Test Plan

  • Backend unit tests pass (cd backend && uv run pytest tests/unit)
  • Frontend unit tests pass (cd frontend && npm run test)
  • Backend E2E tests pass (docker compose exec -T backend sh -c 'uv sync --group test --no-dev --frozen --no-install-project --no-build && pytest tests/e2e')
  • Frontend E2E tests pass (cd frontend && npm run test:e2e)
  • API spec and client regenerated if routes or schemas changed (uv run python -m scripts.export_openapi in backend/, then npm run generate:api in frontend/), never edited by hand
  • Manual testing performed

Validation: ruff, strict mypy, grimp, 552 unit and 3 contract tests and every frontend gate pass. The old and new entrypoint.sh give identical output.

Checklist

  • My code follows the project's style guidelines
  • I have run pre-commit run --all-files and all checks pass
  • I have added tests that prove my fix/feature works
  • I have updated documentation if needed
  • My changes don't introduce new warnings

Summary by cubic

Fixes 123 of the 164 SonarCloud findings on main and documents why the other 41 are acceptable. Only two changes affect behavior: events built in code now validate like events read from Kafka, and the cancel endpoint stops accepting a request body that nothing has stored since #428.

Behavioral changes

  • BaseEvent sets revalidate_instances="always", so metadata and resource usage built in code get the same validation as events read from Kafka.
  • The cancel route drops its reason body; FastAPI ignores undeclared bodies, so existing clients still work. The OpenAPI spec, generated client, and documentation are regenerated to match.

Cleanups and refuted findings

  • 45 routes drop a response_model identical to their return annotation; the spec stays byte-identical.
  • Redis Lua scripts register once, six methods that awaited nothing are now plain, and unused parameters and getattr calls go. The shell entrypoint names its positional parameters.
  • The editor loses its !important copies of the CodeMirror height rules; TypeScript cleanups use a Set for active statuses, a Record for failure messages, Number.isNaN, and String.raw selectors.
  • Docs: 30 Mermaid overrides never applied because Material draws diagrams in a shadow root (pixel-identical before/after); extra.css never loaded in Swagger iframes, so the filter box is now hidden via a fresh swagger.css.
  • The 41 refuted findings: 26 duplicated literals are span names, Mongo operators, and log event names; 7 async functions serve Starlette/APScheduler; the remaining !importants are the reduced-motion reset; the email regex is linear; and RedactingFilter.filter returns True by contract.