Skip to content

Resolve SonarCloud findings in the CI test front controller - #163

Merged
ValeriaMaltseva merged 1 commit into
2026.xfrom
fix/sonar-safe-findings
Oct 22, 2026
Merged

ValeriaMaltseva merged 1 commit into
2026.xfrom
fix/sonar-safe-findings

Conversation

@ValeriaMaltseva

Copy link
Copy Markdown
Contributor

Changes in this pull request

Part of pimcore/service-operations#1507: make the SonarCloud quality gate on the default branch green.

This fixes the findings in the CI test front controller .github/ci/files/public/index_test.php. There is no behavior change:

Rule Change
php:S2007 ×3 (blocker) Run the request handling in a static closure, so $request, $kernel and $response no longer live in the global scope. Call order is unchanged
php:S2003 (bug) Include the autoloader with include_once

Additional info

  • index_test.php is a CI-only front controller. No test suite or config in this repo refers to it, since there are only Unit tests here. php -l passes.
  • Not in this PR: githubactions:S7637 ×2 in .github/workflows/copilot-setup-steps.yml. That file is synced from pimcore/workflows-collection-public (.github/sync-templates/copilot-setup-steps.yml), so a change here would be overwritten, and its version tags are kept on purpose. These two keep the gate red (security rating C, 2 major) until they're accepted in SonarCloud or handled in the sync template.

🤖 Generated with Claude Code

- php:S2003: include the autoloader with include_once
- php:S2007 (x3): run the request handling in a static closure so no
  variables live in the global scope

Same flow, no behavior change.

Co-Authored-By: Claude <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 21, 2026 16:51
@sonarqubecloud

Copy link
Copy Markdown

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The file-inclusion change warrants maintainer security confirmation, and runtime equivalence remains unverified.

No open issues 🎉

What changed in this PR

Addresses SonarCloud findings in the CI-only test front controller while preserving the visible request-handling order.

Changes:

  • Uses include_once for the autoloader.
  • Moves request handling into a static closure to avoid global variables.
File Description
.github/​ci/​files/​public/​index_test.php Updates autoloader inclusion (line 15) and isolates request handling (lines 23–40).

Review effort: Balanced

@ValeriaMaltseva ValeriaMaltseva added this to the 2026.4.0 milestone Oct 21, 2026
@ValeriaMaltseva
ValeriaMaltseva merged commit ca59a57 into 2026.x Oct 22, 2026
21 of 22 checks passed
@ValeriaMaltseva
ValeriaMaltseva deleted the fix/sonar-safe-findings branch October 22, 2026 08:44
@github-actions github-actions Bot locked and limited conversation to collaborators Oct 22, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants