chore: clear sonarcloud code smells failing the quality gate

[NachoVazquez]

TL;DR

SonarCloud's quality gate has been ERROR on main while the GitHub check stayed green — 22 code smells and 122 minutes of debt fail the gate's overall-code conditions, and the scan job never waits for the verdict. This PR fixes the 5 actionable smells and excludes the rule behind the other 17, which are deliberate.

Files to review (6, +24 / −16):

File	Why
sonar-project.properties (start here)	Adds the S5914 exclusion — the only change that needs a judgment call.
packages/internal/test-util/src/lib/spy-driver/spy.driver.ts	S1444: driverIdentifier was the lone mutable one across six drivers.
e2e/examples/lumberjack-app-e2e/src/e2e/console-driver.cy.ts	S7721: visit hoisted out of the describe callback.
packages/ngworker/lumberjack/src/lib/logging/lumberjack-log-factory.spec.ts	S8754: two tests shared a title.
tools/scripts/configure-sonar-report-paths.mjs	S7785: async IIFE → top-level await.
tools/scripts/delete-path-alias.mjs	S7772: fs → node:fs.

Why

The gate fails on two conditions, both scoped to overall code: code_smells > 0 (actual: 22) and sqale_index > 0 (actual: 122 min). Every new-code condition passes — 0 new smells, 0 new debt — as do coverage (99.7%), duplication (0.7%), and all six ratings. Nothing recent caused this; the oldest findings date to 2020-12.

Three of the five fixed smells appeared without anyone touching the code. S7772, S7785, and S7721 ship in newer analyzer versions and started flagging files that had been stable for years.

How

17 of the 22 are a single rule, typescript:S5914 ("assertion always succeeds"), and every one sits in a *-api.spec.ts public-API-surface test:

it('exposes LumberjackConfig', () => {
  const value: LumberjackConfig | undefined = undefined;

  expect(value).toBeUndefined();  // <- S5914
});

Sonar is right that the runtime assertion can't fail, and wrong that it matters. The test is the type annotation — drop the export and this file stops compiling. Rewriting the assertion to satisfy the rule would delete the thing being tested, so the rule is excluded for that file pattern instead. The remaining 5 are genuine and fixed in place.

Reviewer notes

• The exclusion is scoped to one rule and one pattern. sonar.issue.ignore.multicriteria targets typescript:S5914 on **/*-api.spec.ts only. S5914 elsewhere still reports, and the API specs still get every other rule.
• readonly on SpyDriver is consistency, not rule-appeasement. LumberjackHttpDriver, LumberjackConsoleDriver, NoopDriver, ObjectDriver, and ErrorThrowingDriver all already declare static readonly driverIdentifier. SpyDriver was the only holdout.
• The duplicate test titles were not duplicate tests. The second one asserts that logs built at different times carry different timestamps, so it is renamed to say that rather than deleted.
• Top-level await is safe here. configure-sonar-report-paths.mjs is ESM and package.json pins engines.node >= 22.

Tests

No new tests — every change is a lint-level fix or config. Full verification run locally:

• nx run-many --target=lint --max-warnings=0 — 7 projects, clean
• nx run-many --target=test — 4 projects; ngworker-lumberjack alone is 32 suites / 193 tests
• nx build ngworker-lumberjack — succeeds
• nx format:check — clean
• configure-sonar-report-paths.mjs run against a scratch copy of the properties file: exits 0, both placeholders replaced, all three exclusion lines survive the rewrite

Whether the exclusion actually suppresses all 17 findings can only be confirmed by the post-merge analysis on main — SonarCloud evaluates only new-code conditions on pull requests, so this PR's own check will not prove it.

Follow-up

1. Drop code_smells > 0 and sqale_index > 0 from Ngworkers Quality Gate (id 40275). Overall-code conditions guarantee main goes red again on the next analyzer release, and new_code_smells > 0 already covers what matters. Requires org-admin access in the SonarCloud UI.
2. Add sonar.qualitygate.wait=true to the scan step so the GitHub check reflects the gate instead of passing on upload. Worth doing only after (1) lands — otherwise a red gate silently becomes a red main.

Links

• SonarCloud project dashboard
• Open issues (22)

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 86df674

Command	Status	Duration	Result
nx affected -t test --configuration=ci	✅ Succeeded	15s	View ↗
nx affected -t lint build e2e	✅ Succeeded	30s	View ↗
nx run-many --target=test --configuration=ci --...	✅ Succeeded	13s	View ↗
nx-cloud record -- nx format:check	✅ Succeeded	1s	View ↗
nx run-many --target=lint --configuration=repor...	✅ Succeeded	21s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-07-25 19:37:08 UTC

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud