fix(ci): establish protected Sonar baseline

.github/actions/protected-sonar/action.yml

@@ -35,11 +35,13 @@ runs:
         args: >-
           -Dsonar.organization=${{ inputs.organization }}
           -Dsonar.projectKey=${{ inputs.project-key }}
+          -Dsonar.projectVersion=0.1.0-sonar.1
           -Dsonar.scm.revision=${{ inputs.candidate-sha }}
           -Dsonar.sources=.
           -Dsonar.tests=.
-          -Dsonar.exclusions=coverage/**,dist/**,node_modules/**,.omx/**,package-lock.json,tsconfig.tsbuildinfo,**/*_test.go,src/**/*.test.ts,src/**/*.test.tsx,src/test/**
-          -Dsonar.test.inclusions=**/*_test.go,src/**/*.test.ts,src/**/*.test.tsx
+          -Dsonar.exclusions=coverage/**,dist/**,node_modules/**,.omx/**,package-lock.json,tsconfig.tsbuildinfo
+          -Dsonar.test.inclusions=**/*_test.go,src/**/*.test.ts,src/**/*.test.tsx,src/test/**,scripts/**/*.test.sh,scripts/**/test-*.sh,scripts/**/test_*.py,scripts/**/test_*.cjs
+          -Dsonar.coverage.exclusions=.github/**,scripts/**,vite.config.ts
           -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info
           -Dsonar.go.coverage.reportPaths=coverage/go.out
           -Dsonar.qualitygate.wait=true

scripts/ci/test_workflow_structure.py

@@ -8,6 +8,8 @@
 ROOT = Path(__file__).resolve().parents[2]
 QUALITY = (ROOT / ".github/workflows/quality.yml").read_text()
 SONAR = (ROOT / ".github/workflows/sonar-exact-revision.yml").read_text()
+PROTECTED_SONAR = (ROOT / ".github/actions/protected-sonar/action.yml").read_text()
+SONAR_PROPERTIES = (ROOT / "sonar-project.properties").read_text()
 PACKAGE = json.loads((ROOT / "package.json").read_text())
 
 
@@ -100,6 +102,28 @@ def test_frontend_coverage_gate_and_candidate_report_are_separate(self):
             "--coverage.thresholds.statements=0",
         )
 
+    def test_sonar_scope_matches_enforced_application_coverage(self):
+        values = {
+            "sonar.projectVersion": "0.1.0-sonar.1",
+            "sonar.exclusions": (
+                "coverage/**,dist/**,node_modules/**,.omx/**,package-lock.json,"
+                "tsconfig.tsbuildinfo"
+            ),
+            "sonar.test.inclusions": (
+                "**/*_test.go,src/**/*.test.ts,src/**/*.test.tsx,src/test/**,"
+                "scripts/**/*.test.sh,scripts/**/test-*.sh,scripts/**/test_*.py,"
+                "scripts/**/test_*.cjs"
+            ),
+            "sonar.coverage.exclusions": ".github/**,scripts/**,vite.config.ts",
+        }
+
+        for key, value in values.items():
+            self.assertIn(f"{key}={value}\n", SONAR_PROPERTIES)
+            self.assertIn(f"-D{key}={value}\n", PROTECTED_SONAR)
+
+        self.assertNotIn("sonar.exclusions=.github/**", SONAR_PROPERTIES)
+        self.assertNotIn("-Dsonar.exclusions=.github/**", PROTECTED_SONAR)
+
     def test_candidate_tree_is_rejected_on_both_sides_of_approval(self):
         self.assertEqual(SONAR.count("trusted-main/scripts/ci/validate-candidate-tree.sh"), 2)
         self.assertIn("security_base_sha: ${{ steps.control-plane-change.outputs.security_base_sha }}", SONAR)

sonar-project.properties

@@ -1,8 +1,10 @@
 sonar.sources=.
 sonar.tests=.
+sonar.projectVersion=0.1.0-sonar.1
 
-sonar.exclusions=coverage/**,dist/**,node_modules/**,.omx/**,package-lock.json,tsconfig.tsbuildinfo,**/*_test.go,src/**/*.test.ts,src/**/*.test.tsx,src/test/**
-sonar.test.inclusions=**/*_test.go,src/**/*.test.ts,src/**/*.test.tsx
+sonar.exclusions=coverage/**,dist/**,node_modules/**,.omx/**,package-lock.json,tsconfig.tsbuildinfo
+sonar.test.inclusions=**/*_test.go,src/**/*.test.ts,src/**/*.test.tsx,src/test/**,scripts/**/*.test.sh,scripts/**/test-*.sh,scripts/**/test_*.py,scripts/**/test_*.cjs
+sonar.coverage.exclusions=.github/**,scripts/**,vite.config.ts
 
 sonar.javascript.lcov.reportPaths=coverage/lcov.info
 sonar.go.coverage.reportPaths=coverage/go.out