Skip to content

chore(sigrid): leave vendored tooling out of the analysis scope - #905

Closed
rubenvdlinde wants to merge 1 commit into
developmentfrom
chore/sigrid-exclude-vendored-tooling
Closed

rubenvdlinde wants to merge 1 commit into
developmentfrom
chore/sigrid-exclude-vendored-tooling

Conversation

@rubenvdlinde

Copy link
Copy Markdown
Contributor

What

Leaves vendored tooling out of the Sigrid analysis scope. Adds a minimal sigrid.yaml holding only an exclude: list. It sets no model pin, languages or components, so Sigrid's automatic detection and default excludes still apply.

Excluded paths, one line each

  • .*/[.]claude/.*: Claude Code developer tooling (skills, agents, config), partly copied from upstream with its own licence and update script; not part of the shipped app. no tracked files today; the exclusion keeps a later vendored skill out, as happened in shillinq and buildiq. The files stay in the repository for developers.

Nothing written as this app's own code is excluded.

Why

Decision of 1 November: exclude .claude/** and other vendored tooling from Sigrid in every app. Sigrid's default excludes cover .github/ but not .claude/.

Checked

  • The file validates against https://www.schemastore.org/sigrid-scope-file.schema.json.
  • Gate 122 (check_sig_maintainability.py) reads the top-level exclude: of sigrid.yaml, so the proxy and Sigrid scope the same files; confirmed its parser returns the new pattern(s) for this tree.
  • Same caveat as the earlier scope-file PRs: Sigrid reads sigrid.yaml when a repository is published to it; whether SIG uses it for an imported assessment is not documented.

AI-assisted (Claude Code); reviewed and submitted by a human.

🤖 Generated with Claude Code

Exclude .claude/** (Claude Code skills and agent config, partly copied
from upstream) from the Sigrid analysis scope.

Assisted-by: ClaudeCode:claude-opus-5-5
@github-actions

github-actions Bot commented Nov 1, 2026

Copy link
Copy Markdown
Contributor

Quality Report — ConductionNL/launchpad @ 16e4d9d

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
format ❌
check-schema-l10n ✅
composer ✅ ✅ 107/107
npm ❌ ✅ 636/636
app:check-code ⏭️
info.xml ✅
REUSE ❌
lockfile sync ✅
PHPUnit ⏭️ not run for this diff — no file in this diff matches the code globs, and none carries a source extension — the heavy tier has nothing to decide about it.
Newman ✅ 224/224
Playwright ⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates ❌

Quality workflow — 2026-11-01 20:52 UTC

Download the full PDF report from the workflow artifacts.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant