Add CI quality pipeline with GitHub Actions and SonarCloud

.github/workflows/ci-quality.yml

@@ -0,0 +1,79 @@
+name: CI Quality Pipeline
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+
+jobs:
+  unit-tests:
+    name: Unit Tests & Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+      - run: npm ci
+      - name: Run unit tests with coverage
+        run: npm run test:ci
+        env:
+          NODE_OPTIONS: --experimental-vm-modules
+      - uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage/lcov.info
+          retention-days: 1
+
+  e2e-tests:
+    name: E2E Tests
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: vulnerablenode
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+      - run: npm ci
+      - name: Run E2E tests
+        run: npm run test:e2e
+        env:
+          NODE_OPTIONS: --experimental-vm-modules
+          DATABASE_URL: postgres://postgres:postgres@localhost:5432/vulnerablenode
+          SESSION_SECRET: ci-test-secret-key
+
+  sonarcloud:
+    name: SonarCloud Analysis
+    runs-on: ubuntu-latest
+    needs: [unit-tests]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/download-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage/
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarcloud-github-action@v3
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -38,7 +38,6 @@ jspm_packages
 .npm
 .node_repl_history
 
-# Claude / MCP / GitHub config
+# Claude / MCP config
 .claude/
-.github/
 .playwright-mcp/

package.json

@@ -9,7 +9,8 @@
     "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
     "test:unit": "node --experimental-vm-modules node_modules/jest/bin/jest.js --testPathPattern=tests/unit",
     "test:integration": "node --experimental-vm-modules node_modules/jest/bin/jest.js --testPathPattern=tests/integration",
-    "test:e2e": "node --experimental-vm-modules node_modules/jest/bin/jest.js --testPathPattern=tests/e2e"
+    "test:e2e": "node --experimental-vm-modules node_modules/jest/bin/jest.js --testPathPattern=tests/e2e",
+    "test:ci": "node --experimental-vm-modules node_modules/jest/bin/jest.js --testPathPattern=tests/unit --coverage --coverageReporters=lcov --coverageReporters=text-summary --forceExit"
   },
   "dependencies": {
     "cookie-parser": "^1.4.7",

sonar-project.properties

@@ -0,0 +1,37 @@
+sonar.projectKey=esaban17_vulnerable-node
+sonar.organization=esaban17
+sonar.projectName=vulnerable-node-rehabilitated
+
+sonar.sources=model,routes,src
+sonar.tests=tests
+sonar.sourceEncoding=UTF-8
+sonar.javascript.file.suffixes=.js
+
+sonar.javascript.lcov.reportPaths=coverage/lcov.info
+
+sonar.exclusions=\
+  node_modules/**,\
+  coverage/**,\
+  public/**,\
+  views/**,\
+  services/**,\
+  docs/**,\
+  logs/**,\
+  dist/**,\
+  **/*.min.js,\
+  **/*.test.js,\
+  **/*.spec.js,\
+  dummy.js,\
+  bin/**
+
+sonar.coverage.exclusions=\
+  tests/**,\
+  dummy.js,\
+  config.js,\
+  bin/**,\
+  model/init_db.js,\
+  model/db.js
+
+sonar.cpd.exclusions=\
+  tests/**,\
+  public/**