sonar-project.properties

# SonarQube Cloud analyses this repository with Automatic Analysis (GitHub App, no CI-based
# scan: https://sonarcloud.io/dashboard?id=MPCoreDeveloper_SafeWebCore). Automatic Analysis
# reads this file from the repository root and honours the documented subset of properties,
# which includes sonar.sources, sonar.inclusions, sonar.exclusions, sonar.tests,
# sonar.test.exclusions, sonar.test.inclusions, sonar.sourceEncoding and sonar.cpd.exclusions.
#
# Only product code belongs in the analysis scope. The BMad Method tooling (.agents/skills,
# the byte-identical _bmad runtime copies) and the artifacts it renders (_bmad-output) are
# not project code, but they were analysed as sources: 325 of 327 issues, all six
# vulnerabilities and the 99 % copy-paste blocks between .agents/skills/bmad/scripts and
# _bmad/scripts came from there and failed the quality gate (58.5 % duplicated lines and a D
# security rating on new code). Excluding them keeps the gate about SafeWebCore itself.
sonar.exclusions=.agents/**,_bmad/**,_bmad-output/**,docs/**,artifacts/**,**/bin/**,**/obj/**