Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

feat(quality): Sonar — every gate green, coverage reported in every repo, numbers that only go down

Open
  • Is something wrong?
#377 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions, javascript, python
Domain
ci-cd, devops, observability, testing

Research direction

Start with the SonarCloud findings and coverage settings listed for each repository, then inspect the referenced tools/brand-films/** scripts, .github/workflows, and the repositories’ test and Sonar configuration. Tackle one checklist item in a small PR: fix the listed findings or configure coverage reporting for that repo. Done means the change addresses the actual findings or produces a coverage number and badge; the broader gate and smells ratchet needs coordinated work across repositories.

Written by the indexing model from the issue text.

Description

Founder (2026-10-28, Sonar board screenshot): « les chiffres doivent se stabiliser et descendre, et on doit avoir les bons chiffres de couverture ».

State (SonarCloud, 2026-10-28):

  • Gates failed: krizaka-ui (63 vulnerabilities, all in tools/brand-films/** Python render scripts: pythonsecurity S8707 ×31, S8705 ×8, S2083 path injection ×6, javascript S4036 ×6), krizaka-build (5 in .github/workflows: S6505 ×3, S8234, S8543; 3 bugs), krizaka-blog (2 bugs).
  • Coverage not reported: orazaka-ai-engine, orazaka-web-client, orazaka-packs (« Measure has not been found »); krizaka-ts 0 % (lcov not sent or wrong paths).
  • Code smells: krizaka-ui 1.9k, akinaza 496, orazaka-web-client 268, krizaka-com 252, blog 251, krizaka-ts 180, yomizaka 136.

Checklist (one small PR per item, causes fixed, never « won't fix » to pass, never an exclusion of real sources):

  • krizaka-ui: fix the brand-films script findings for real (validated paths, no shell with variable PATH); if a script is dead, delete it.
  • krizaka-build: the 5 workflow findings + 3 bugs.
  • krizaka-blog: the 2 bugs.
  • Coverage reported everywhere: JaCoCo XML → Sonar for orazaka-ai-engine and orazaka-packs; vitest lcov → Sonar for orazaka-web-client; fix krizaka-ts lcov paths (monorepo). Each repo's badge shows a number.
  • Ratchet so numbers only go down: the quality gate « Sonar way » on new code (coverage on new code ≥ 80 %, no new bugs/vulns/smells over threshold) applied to all repos; a per-repo smells count in the checkpoint (lower each week).
  • Smells: one rule family per PR, highest-count rules first, per repo, as the lanes touch the code (the block plan budgets one Sonar PR per block).
Dominant language
No language data
Stars
0
Forks
0
Avg merge
1h 45m
Merged PRs (30d)
192

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from krizaka/.github

All issues in krizaka/.github

Similar issues

More DevOps issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.