GeezerVison is showing github.com — EngineScript/.codacy.yml at master · EngineScript/EngineScript

Expand file tree

.codacy.yml

Copy path

More file actions

Latest commit

History

123 lines (110 loc) · 4.29 KB

.codacy.yml

Copy path

File metadata and controls

123 lines (110 loc) · 4.29 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

---

# Codacy Configuration for EngineScript

# Excludes API endpoint patterns that are intentional by design

exclude_paths:

# WordPress core files - not under our control

- 'config/var/www/wordpress/wp-config.php'

- 'config/var/www/wordpress/**'

engines:

# TSLint is deprecated and is switched off for this repository in Codacy,

# yet Codacy may still run it, as it did in the plugin repositories. It is

# turned off from here in two ways: tslint.json enables no rule, and the

# paths below keep every file away from the tool. The two JSON files are

# named as well, because they are what it flagged there: it asked for

# trailing commas and sorted keys, which JSON and npm's lock file cannot

# have. Every other tool still reads every file.

tslint:

exclude_paths:

- "**"

- "**/*"

- "package.json"

- "package-lock.json"

# Lizard reads the lock files as source code and reports their length.

# Composer and npm generate them; nobody writes them by hand.

lizard:

exclude_paths:

- "composer.lock"

- "package-lock.json"

- "**/composer.lock"

- "**/package-lock.json"

# PHP Code Sniffer Configuration

phpcs:

enabled: true

exclude_patterns:

# API endpoint files use intentional patterns for HTTP responses

- 'config/var/www/admin/control-panel/api.php'

configuration:

# Use PSR-12 standard but allow API endpoint patterns

standard: PSR12

# Markdown Linting Configuration

markdownlint:

enabled: true

exclude_patterns:

# Documentation with URLs and technical content needs flexible line length

- '**/README.md'

configuration:

# Disable line length rules for documentation

MD013: false # Line length

MD033: false # Inline HTML allowed

MD041: false # First line heading level

# PHP Mess Detector Configuration

phpmd:

enabled: true

exclude_patterns:

# API files have intentional patterns

- 'config/var/www/admin/control-panel/api.php'

configuration:

rulesets:

- cleancode

- codesize

- design

- naming

# Ignore specific rules for API files

exclude:

- ExitExpression # API endpoints must exit after JSON output

- ElseExpression # Necessary for feed parsing logic

- LongMethod # Feed parsers are inherently complex

# Security Analysis Configuration

codacy-security-patterns:

enabled: true

exclude_patterns:

# API endpoint files require $_GET, header(), echo for functionality

- 'config/var/www/admin/control-panel/api.php'

# Pattern-Specific Suppressions

patterns:

# Suppress WordPress-specific rules for non-WordPress code

- pattern_id: CSRF_NonceMissing

enabled: false

reason: "Not a WordPress project - CSRF protection via CORS and input validation"

- pattern_id: WordPress_InputNotUnslashed

enabled: false

reason: "Not a WordPress environment - wp_unslash() function doesn't exist"

# Suppress discouraged function warnings for legitimate API endpoint use

- pattern_id: PHP_DiscouragedFunctions

parameters:

exclude_functions:

- header # Required for Content-Type in API responses

- echo # Required for JSON output in API endpoints

- exit # Required to terminate after API response

- die # Required for security (forbidden access)

- file_get_contents # Used for outbound HTTP requests with timeout

- stream_context_create # Required for HTTP timeout configuration

reason: "API endpoints require these functions for proper HTTP response handling"

# Suppress direct superglobal access when properly validated

- pattern_id: PHP_DirectSuperglobalAccess

exclude_paths:

- 'config/var/www/admin/control-panel/api.php'

reason: "Input validated against strict whitelists and sanitized before use"

# Allow require_once for module inclusion with __DIR__ constant

- pattern_id: PHP_FileManipulation

parameters:

allow_constants:

- __DIR__

- __FILE__

reason: "Module inclusion with hardcoded paths is safe and necessary"

# Custom Ignore Comments

# Codacy recognizes these formats in code:

# - @codacy ignore <rule_name>

# - @codacy [<rule_description>] <explanation>

# - codacy-disable

# - codacy-enable