Metadata-Version: 2.4
Name: supersonar
Version: 0.3.3
Summary: A SonarQube-like static analysis CLI for multi-language repositories.
Author: Supersonar Contributors
License-Expression: MIT
Project-URL: Homepage, https://github.com/mortaccio/supersonar
Project-URL: Repository, https://github.com/mortaccio/supersonar
Project-URL: Issues, https://github.com/mortaccio/supersonar/issues
Keywords: static-analysis,lint,security,ci,sonarqube
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Environment :: Console
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: tomli>=2.0.1; python_version < "3.11"

# supersonar

`supersonar` is a lightweight, SonarQube-inspired static analysis CLI for multi-language repositories.
It is designed for local use and CI pipelines via `pip install` (Python 3.10+).

## Quick start

```bash
pip install .
supersonar scan . --format json
```

## Pipeline install (pip)

Use an isolated environment in CI:

```bash
python -m venv .venv
. .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install supersonar
supersonar --version
supersonar scan . --format sarif --out reports/supersonar.sarif
```

Or install from repository source directly:

```bash
python -m pip install "git+https://github.com/mortaccio/supersonar.git@main"
```

The scanner performs real code checks (AST + regex), including:
- dynamic execution (`eval`/`exec`)
- broad exception handlers
- `subprocess.*(..., shell=True)` in Python
- unsafe `yaml.load(...)` in Python
- hardcoded secret-like assignments
- private key block markers (for example `BEGIN ... PRIVATE KEY`)
- TODO/FIXME markers
- unresolved merge conflict markers

Python files use AST rules. Other file types use generic cross-language text rules.

## CI usage

```bash
pip install supersonar
supersonar scan . \
  --format sarif \
  --out reports/supersonar.sarif \
  --fail-on high \
  --max-high 0 \
  --max-critical 0 \
  --coverage-xml coverage.xml \
  --min-coverage 80
```

## Config (`supersonar.toml`)

```toml
[scan]
exclude = [".git", ".venv", "venv", "build", "dist", "__pycache__"]
include_extensions = [".py", ".java", ".js", ".ts", ".go", ".rs", ".cs", ".yaml", ".yml", ".json", ".toml"]
include_filenames = ["Dockerfile", "Jenkinsfile", "Makefile"]
max_file_size_kb = 1024
skip_generated = true
inline_ignore = true
disabled_rules = []
# enabled_rules = ["SS001", "SS003"]
coverage_xml = "coverage.xml"

[quality_gate]
fail_on = "high"
max_issues = 200
max_files_with_issues = 25
max_high = 0
max_critical = 0
min_coverage = 80.0
baseline_report = "reports/supersonar-baseline.json"
only_new_issues = true

[report]
format = "json"
```

Use CLI overrides when needed:

```bash
supersonar scan . --include-ext .java --include-ext .kt --include-file Dockerfile
```

## Quality gates

- `fail_on`: fail if any issue exists at/above severity
- `max_issues`: fail if total issues exceed threshold
- `max_files_with_issues`: fail if number of files with at least one issue exceeds threshold
- `max_low`, `max_medium`, `max_high`, `max_critical`: per-severity caps
- `min_coverage`: minimum line coverage percentage from Cobertura XML
- `baseline_report` + `only_new_issues`: gate only on issues not present in a previous report

Generate `coverage.xml` in Python projects with:

```bash
python -m pip install coverage
coverage run -m pytest
coverage xml -o coverage.xml
```

## Noise control

- Generated artifacts are skipped by default (`target/`, `.mypy_cache/`, `.pytest_cache/`, `.tox/`, `.nox/`, `.gradle/`, `node_modules/`, and common binary suffixes).
- Use `--include-generated` when you explicitly want to scan generated/build outputs.
- Inline suppression is supported per line:
  - `# supersonar:ignore` ignores all rules on that line.
  - `# supersonar:ignore SS001,SS007` ignores specific rules on that line.
- Rule-level controls:
  - `--disable-rule SS004` (repeatable)
  - `--enable-rule SS001 --enable-rule SS003` (allowlist mode)
