fix(quality): Sonar-zero remediation R1 (mechanical bulk, 29 files)

Closed
PR
5mo ago
+3-0

User description

First remediation pass toward quality-zero Sonar true-zero (329 → ?). Mechanical/pattern fixes across 29 files; complexity/compiler-dependent issues deferred to R2.

Fixed: S8409 (FastAPI response_model dupes), S8410 (Annotated DI), S1192 (duplicate-literal constants), S6535/S4325/S6759/S7764 (TS escape/assertion/readonly/globalThis), S3358/S4624 (ternary/template), S4084 (media <track>), S6853 (label a11y), + a cross-file fix (worker.py provider= dropped to match score_segments_llm).

Deferred to R2 (need a compiler/tests to fix safely): S1874 (deprecated React.FormEvent/execCommand), remaining S4325, S3776 (cognitive complexity ×~29), S2004 (nesting).

CI + SonarCloud on this PR are the authoritative re-scan — I'll iterate R2 on whatever remains (and any regressions, e.g. the main.tsx !-removal under strict TS).

Summary by cubic

Quality-zero R1 expanded to lint-zero and coverage-100 across the monorepo, with safer parsing and a large test sweep to stabilize CI. Also forwarded CI visual/codex secrets and applied a non‑breaking web deps audit fix (no criticals) to keep gates green.

  • Refactors

    • Drove ruff/pylint/eslint to zero; added docstrings, constants, and clearer errors across API modules.
    • Hardened parsers and helpers: VTT/SRT timing, SRT translate/parse, subtitle grouping/shift, path guard, and lazy‑imported transcription/diarization backends with graceful fallbacks.
    • FFmpeg wrappers use named flags and better error handling; web code uses globalThis, fewer non‑null assertions, and readonly props.
    • services/worker Groq client finalized with offline gating; API client types tightened; minor UI/a11y polish continues (native <dialog>, button contrast).

  • Tests/CI

    • Added branch‑coverage suites for API (auth/identity, billing/Stripe, publish/collab, assets/jobs/usage), storage backends, media‑core (diarize/transcribe/translate/ffmpeg), and worker end‑to‑end helpers.
    • Isolated rate limiter state per test via new reset helpers to prevent sporadic 429s on fast CI runs.
    • Vitest setup now provides full localStorage/sessionStorage mocks; bumped vitest to 4.1.9 via audit fix to close criticals; web e2e and unit tests are stable.
    • Forwarded CHROMATIC_PROJECT_TOKEN, APPLITOOLS_API_KEY, and CODEX_AUTH_JSON to the quality‑zero workflow scanner matrix.
    • Cross‑platform fixes: SQLite URL building and Windows temp‑file handling in tests; shared worker fixtures. Coverage gates enabled (web at 100%); CI passes reliably.

CodeAnt-AI Description

Improve auth, billing, uploads, and media tools across the app

What Changed

  • Login, SSO, invites, SCIM, and billing flows now return clearer “not found” and “authentication required” responses, with fewer broken edge cases during Okta, OAuth, and Stripe callbacks
  • Uploads, job retries, publish connections, and media exports now handle more cases reliably, including multipart uploads, share links, job bundles, and clip packages
  • Captions, subtitles, and shorts tools now parse and render more input formats, keep timing edits consistent, and surface better results when transcription or scoring falls back
  • Several screens and controls are now keyboard-accessible or more consistent to use, including dialogs, drop zones, media previews, and confirmation prompts

Impact

✅ Fewer failed sign-ins and invite acceptances
✅ Clearer billing and SSO error handling
✅ More reliable uploads and media exports

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

Release Notes

  • New Features
    • Settings modal now uses a native HTML dialog for improved accessibility.
    • Improved keyboard support for upload dropzones.
  • Refactor
    • More consistent API error handling and response metadata across key endpoints.
    • Unified publish-provider typing in the web client.
  • Bug Fixes
    • Improved system status diagnostics rendering.
    • Safer cleanup for subtitle editor downloads and object URLs.
  • Style
    • Updated dark mode button background.
  • Tests
    • Added browser storage polyfills for more reliable test runs.