chore: fix 27 SonarQube issues across source and test files by shenxianpeng · Pull Request #436 · commit-check/commit-check

shenxianpeng · 2026-06-21T21:24:21Z

Summary

Fixes 27 SonarQube issues reported on the project dashboard across source code and test files.

Source Code Fixes (11 issues)

Rule	Severity	File	Fix
S8707	🛡️ HIGH	`config.py`	Path traversal: use `.resolve()` on config path to normalize user-supplied input
S5713	🧹 MINOR	`config.py`	Remove redundant `HTTPError` (subclass of `URLError`) and `Exception` from except clause
S3776	🔬 CRITICAL	`engine.py`	Reduce cognitive complexity of `_should_skip_commit_validation` — extract `_author_in_ignore_list()` and `_get_commit_body()` helpers
S3776	🔬 CRITICAL	`main.py`	Reduce cognitive complexity of `main()` — extract `_get_requested_checks()`, `_resolve_commit_message_source()`, `_resolve_stdin_for_non_message()`, `_run_json_output()`
S1172	🔌 MAJOR	`engine.py`	Rename unused `subject` → `_subject` in `SubjectValidator._validate_subject()`
S6019	🔍 MAJOR	`engine.py`	Change reluctant `[^<\n]+?` → greedy `[^<\n]+` in co-author regex
S1871	🔄 MAJOR	`engine.py`	Merge 3 duplicate `return PASS` branches in `SubjectLengthValidator`
S1871	🔄 MAJOR	`rule_builder.py`	Merge 3 duplicate `return None` branches in `_build_boolean_rule`
S1192	📝 CRITICAL	`rule_builder.py`	Remove redundant `{1}` in conventional commit regex
S7498	🧹 MINOR	`docs/conf.py`	`dict()` → `{}` literals (×2)

Test File Fixes (16 issues)

String literal duplications replaced with module-level constants across tests/engine_test.py, tests/config_test.py, tests/util_test.py, tests/main_test.py, and tests/rule_builder_test.py.

All 377 existing tests pass. ✅

Summary by CodeRabbit

Release Notes

New Features
- Added a JSON Schema file defining the configuration structure for easier validation and IDE integration.
Bug Fixes
- Improved error handling for remote configuration loading to properly propagate unexpected errors.
- Enhanced path resolution to normalize configuration file paths before processing.
Chores
- Internal refactoring of validation logic and CLI execution flow for maintainability.
- Test updates and code cleanup.

netlify · 2026-06-21T21:24:27Z

✅ Deploy Preview for commit-check ready!

Name	Link
🔨 Latest commit	`ce8a768`
🔍 Latest deploy log	https://app.netlify.com/projects/commit-check/deploys/6a3857fce8423400088b210b
😎 Deploy Preview	https://deploy-preview-436--commit-check.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

coderabbitai · 2026-06-21T21:24:35Z

Warning

Review limit reached

@pre-commit-ci[bot], we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 55 minutes and 12 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8b51f8bc-4617-4ffa-9a7e-741f4a49ddef

📥 Commits

Reviewing files that changed from the base of the PR and between acf9336 and ce8a768.

📒 Files selected for processing (10)

commit_check/config.py
commit_check/engine.py
commit_check/main.py
commit_check/rule_builder.py
docs/conf.py
tests/config_test.py
tests/engine_test.py
tests/main_test.py
tests/rule_builder_test.py
tests/util_test.py

📝 Walkthrough

Walkthrough

Adds commit-check.schema.json defining the full JSON Schema for commit-check configuration. Narrows exception handling and fixes path resolution in config.py. Refactors engine.py to extract author-ignore and commit-body helpers. Decomposes main.py CLI orchestration into four helper functions. Simplifies rule_builder.py conditionals. Centralizes repeated string literals across all test files.

Changes

commit-check schema, config fixes, engine/main refactoring, and test cleanup

Layer / File(s)	Summary
JSON Schema for commit-check configuration `commit-check.schema.json`	Adds a 158-line JSON Schema covering `commit` (conventional commits, message pattern, subject rules, allowed types, flags, ignore_authors), `branch` (conventional branch, types, names, rebase target, ignore_authors), and `push` (allow_force_push) sections.
Config loading: exception narrowing and path resolution `commit_check/config.py`	`_load_from_url` now catches only `urllib.error.URLError` instead of also `HTTPError` and broad `Exception`; `load_config` resolves `path_hint` to an absolute path via `Path(...).resolve()` before checking existence.
Engine: extract author-ignore and commit-body helpers `commit_check/engine.py`	`_should_skip_commit_validation` delegates to a new `_author_in_ignore_list` helper and a new `_get_commit_body` static method; inline `Co-authored-by:` scanning removed. `SubjectValidator` parameter renamed `_subject`; `SubjectLengthValidator` branching collapsed to a compound conditional.
RuleBuilder: simplify boolean rule and regex patterns `commit_check/rule_builder.py`	`_build_boolean_rule` collapses the `if/elif` early-return chain into a single combined condition; `_build_conventional_commit_regex` removes the redundant `{1}` quantifier.
Main CLI orchestration: extract helper functions `commit_check/main.py`	Extracts `_resolve_commit_message_source`, `_resolve_stdin_for_non_message`, `_get_requested_checks`, and `_run_json_output` from `main()`. Positional `commit_msg_file` only sets `args.message=True`, deferring path resolution to the new helpers.
Test constants, mock target centralization, and docs cleanup `tests/config_test.py`, `tests/engine_test.py`, `tests/main_test.py`, `tests/rule_builder_test.py`, `tests/util_test.py`, `docs/conf.py`	Introduces shared constants (`URLOPEN_MODULE`, `EXAMPLE_CONFIG_URL`, `GIT_CONFIG_VALUE`, `REFS_HEADS_MAIN`, `USER_NAME_CONFIG`, `FEATURE_TOPIC_BRANCH`, `BAD_FORMAT_ERROR`, `CONVENTIONAL_COMMIT_REGEX`) across all test files, replacing hard-coded strings. `engine_test` adjusts `get_commit_info` call-count expectation for the refactored ignore-author path. `docs/conf.py` converts `dict(...)` calls to dict literals.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

commit-check/commit-check#292: Directly aligned with this PR's engine.py refactor — both move ignore-author logic into dedicated helpers and use ignore_authors to skip author-related validations.
commit-check/commit-check#357: Shares the same commit_check/main.py CLI/config flow surface, including config keys for ignore authors and branch rules that this PR's schema formalizes.

Suggested labels

minor, developer

🐇 A schema bloomed in JSON today,
helpers hopped into engine.py,
path hints resolved the proper way,
{1} quantifiers swept away —
the rabbit tidied up to stay! 🌿✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main objective: fixing 27 SonarQube issues across the codebase. It is concise and clearly summarizes the primary change from the pull request.
Docstring Coverage	✅ Passed	Docstring coverage is 81.48% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/fix-sonarqube-issues

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Fixes the following SonarQube findings: Source code fixes: - S8707 (VULN): Path traversal - use .resolve() on config path - S5713: Remove redundant Exception subclass in except clause - S3776: Reduce cognitive complexity of _should_skip_commit_validation - S3776: Reduce cognitive complexity of main() by extracting helpers - S1172: Unused parameter _subject in base SubjectValidator - S6019: Reluctant quantifier -> greedy in co-author regex - S1871: Merge duplicate branches in SubjectLengthValidator - S1871: Merge duplicate return None branches in _build_boolean_rule - S1192: Remove redundant {1} in conventional commit regex - S7498: dict() -> {} literal in docs/conf.py (x2) Test file fixes: - S1192: Define constants for duplicated string literals (16 issues across 5 test files) All 377 existing tests pass.

codspeed-hq · 2026-06-21T21:33:54Z

Merging this PR will improve performance by ×2.4

⚠️

Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 52 improved benchmarks
❌ 2 regressed benchmarks
✅ 255 untouched benchmarks
⏩ 108 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	`BASE`	`HEAD`	Efficiency
❌	`test_load_config_with_nonexistent_path_hint`	236.4 µs	279.5 µs	-15.42%
❌	`test_load_config_file_permission_error`	338 µs	376.6 µs	-10.25%
⚡	`test_commit_message_validator_custom_pattern_github_issue`	807.8 µs	189.1 µs	×4.3
⚡	`test_commit_message_validator_custom_pattern_jira`	806.1 µs	189 µs	×4.3
⚡	`test_validation_engine_validate_all_fail`	802.3 µs	195.8 µs	×4.1
⚡	`test_commit_type_validator_merge_commits`	509.3 µs	134.3 µs	×3.8
⚡	`test_commit_type_validator_revert_commits`	509.4 µs	135.1 µs	×3.8
⚡	`test_subject_length_validator_max_valid`	510.8 µs	136.6 µs	×3.7
⚡	`test_validate_with_empty_lines_and_body`	504.6 µs	135.1 µs	×3.7
⚡	`test_subject_length_validator_min_valid`	505.4 µs	135.8 µs	×3.7
⚡	`test_validate_with_body_present`	504.6 µs	135.7 µs	×3.7
⚡	`test_body_validator_with_body`	506.4 µs	137 µs	×3.7
⚡	`test_result_contains_check_names`	1,192.2 µs	326.6 µs	×3.7
⚡	`test_breaking_change_notation_passes`	1,187.4 µs	329.7 µs	×3.6
⚡	`test_commit_with_scope_passes`	1,186.6 µs	329.9 µs	×3.6
⚡	`test_commit_message_validator_valid_conventional_commit`	516.3 µs	144.1 µs	×3.6
⚡	`test_fix_commit_passes`	1,194.2 µs	335 µs	×3.6
⚡	`test_validation_engine_validate_all_pass`	519.9 µs	151.3 µs	×3.4
⚡	`test_validate_with_breaking_change`	517.9 µs	151 µs	×3.4
⚡	`test_custom_config_pass`	1,215 µs	355.6 µs	×3.4
...	...	...	...	...

ℹ️ Only the first 20 benchmarks are displayed. Go to the app to view all benchmarks.

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing chore/fix-sonarqube-issues (ce8a768) with main (a165161)²}

108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
No successful run was found on main (a0f80c1) during the generation of this report, so a165161 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

codecov · 2026-06-21T21:34:14Z

Codecov Report

❌ Patch coverage is 97.05882% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 95.97%. Comparing base (a0f80c1) to head (ce8a768).

Files with missing lines	Patch %	Lines
commit_check/engine.py	95.83%	1 Missing ⚠️
commit_check/main.py	97.50%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #436      +/-   ##
==========================================
+ Coverage   95.95%   95.97%   +0.01%     
==========================================
  Files          10       10              
  Lines        1162     1167       +5     
==========================================
+ Hits         1115     1120       +5     
  Misses         47       47

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

sonarqubecloud · 2026-06-21T21:36:35Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

shenxianpeng requested a review from a team as a code owner June 21, 2026 21:24

github-actions Bot added the bug Something isn't working label Jun 21, 2026

shenxianpeng force-pushed the chore/fix-sonarqube-issues branch from acf9336 to a0858ef Compare June 21, 2026 21:30

ci: auto fixes from pre-commit.com hooks

ce8a768

shenxianpeng merged commit 226e631 into main Jun 21, 2026
32 checks passed

shenxianpeng deleted the chore/fix-sonarqube-issues branch June 21, 2026 21:36

Navigation Menu

Uh oh!

Uh oh!

chore: fix 27 SonarQube issues across source and test files - #436

chore: fix 27 SonarQube issues across source and test files#436
shenxianpeng merged 2 commits into
mainfrom
chore/fix-sonarqube-issues

shenxianpeng commented Jun 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

netlify Bot commented Jun 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jun 21, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Uh oh!

codspeed-hq Bot commented Jun 21, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jun 21, 2026

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jun 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

shenxianpeng commented Jun 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Source Code Fixes (11 issues)

Test File Fixes (16 issues)

Summary by CodeRabbit

Release Notes

Uh oh!

netlify Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for commit-check ready!

Uh oh!

coderabbitai Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Uh oh!

codspeed-hq Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will improve performance by ×2.4

Performance Changes

Footnotes

Uh oh!

codecov Bot commented Jun 21, 2026

Codecov Report

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jun 21, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

shenxianpeng commented Jun 21, 2026 •

edited by coderabbitai Bot

Loading

netlify Bot commented Jun 21, 2026 •

edited

Loading

coderabbitai Bot commented Jun 21, 2026 •

edited

Loading

codspeed-hq Bot commented Jun 21, 2026 •

edited

Loading