Improve SonarCloud quality ratings (#35)

* Improve SonarCloud quality ratings

* Set read-only mode for copied package manifests

* Remove write bits from copied Docker resources

* make code easier to read.

Signed-off-by: Deggen <d.kellenschwiler@bsvassociation.org>

* Fix HTTPWalletJSON originator handling

* Fix all SonarCloud issues in PR #35

- Remove await from socket.emit() call (critical: non-Promise await)
- Replace ternary with nullish coalescing in Engine.ts
- Remove 30+ unnecessary type assertions in BTMS.ts (aliased string/number types)
- Add --ignore-scripts to npm ci in all 18 package push.yaml workflows
- Fix Dockerfile: add --ignore-scripts, pin tsx/typescript versions, merge RUN layers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix BTMS locking script hex conversion

---------

Signed-off-by: Deggen <d.kellenschwiler@bsvassociation.org>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: sirdeggen

.github/workflows/ci.yml

@@ -6,27 +6,26 @@ on:
   pull_request:
     branches: [main]
 
-permissions:
-  contents: read
-  pull-requests: read
-
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     strategy:
       fail-fast: false
       matrix:
         node-version: [24.x]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: pnpm
@@ -56,7 +55,7 @@ jobs:
 
       - name: Upload SDK coverage to Codecov
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: packages/sdk/coverage/lcov.info
@@ -67,19 +66,21 @@ jobs:
 
       - name: SonarCloud scan
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: SonarSource/sonarqube-scan-action@v7
+        uses: SonarSource/sonarqube-scan-action@c7ee0f9df90b7aa20e8dcf9695dcfe2e7da5b4f2 # v7
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
   conformance:
     name: Conformance Vectors
     runs-on: ubuntu-latest
     needs: [build-and-test]
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -94,7 +95,7 @@ jobs:
 
       - name: Upload conformance reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: conformance-report
           path: conformance/reports/
@@ -104,7 +105,7 @@ jobs:
       # See conformance/GO_PLAN.md for migration status.
       - name: Publish conformance vectors
         if: github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: conformance-vectors
           path: conformance/vectors/

.github/workflows/codegen.yml

@@ -6,20 +6,19 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions:
-  contents: write
-
 jobs:
   generate:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       # ── Go types (oapi-codegen) ───────────────────────────────────────────
       # NOTE: oapi-codegen does not yet support OpenAPI 3.1 nullable syntax
       # (type: [string, null]). Steps are continue-on-error until resolved.
       # Upstream: https://github.com/oapi-codegen/oapi-codegen/issues/373
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: '1.22'
       - name: Install oapi-codegen
@@ -47,7 +46,7 @@ jobs:
             > conformance/generated/messaging/types.gen.go
 
       # ── TypeScript types (openapi-typescript) ────────────────────────────
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '24'
       - name: Generate TS types from overlay spec
@@ -67,7 +66,7 @@ jobs:
             -o conformance/generated/messaging/types.gen.d.ts
 
       # ── Python types (datamodel-code-generator / pydantic v2) ────────────
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.12'
       - name: Install datamodel-code-generator
@@ -118,7 +117,7 @@ jobs:
           EOF
 
       # ── Single commit for all generated files ────────────────────────────
-      - uses: stefanzweifel/git-auto-commit-action@v5
+      - uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5
         with:
           commit_message: "chore(codegen): regenerate types from OpenAPI specs"
           file_pattern: "conformance/generated/**"

.github/workflows/conformance.yml

@@ -10,11 +10,11 @@ jobs:
   ts-runner:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '24'
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6
       - name: Install deps
         run: pnpm install --no-frozen-lockfile
       - name: Build TS SDK
@@ -28,7 +28,7 @@ jobs:
         working-directory: ${{ github.workspace }}/conformance/runner/ts
       - name: Upload TS conformance reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: ts-conformance-reports
           path: conformance/reports/
@@ -38,7 +38,7 @@ jobs:
       # See conformance/GO_PLAN.md for migration status.
       - name: Publish conformance vectors
         if: github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: conformance-vectors
           path: conformance/vectors/

.github/workflows/docs-deploy.yml

@@ -11,26 +11,23 @@ on:
       - '.github/workflows/docs-deploy.yml'
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 concurrency:
   group: pages
   cancel-in-progress: false
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '24'
           cache: 'pnpm'
@@ -52,18 +49,21 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/configure-pages@v5
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: docs-site/dist
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/release.yaml

@@ -14,13 +14,13 @@ jobs:
       id-token: write   # required for npm OIDC provenance
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org

docs-site/index.html

@@ -4,9 +4,6 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="theme-color" content="#0c0c14" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet" />
     <title>ts-stack</title>
   </head>
   <body>

docs-site/scripts/check-links.mjs

@@ -24,14 +24,29 @@ function walk(dir) {
 const files = walk(DOCS_ROOT)
 let errors = 0
 
+function extractMarkdownLinks(content) {
+  const links = []
+  let offset = 0
+  while (offset < content.length) {
+    const labelEnd = content.indexOf('](', offset)
+    if (labelEnd === -1) break
+
+    const linkStart = labelEnd + 2
+    const linkEnd = content.indexOf(')', linkStart)
+    if (linkEnd === -1) break
+
+    links.push(content.slice(linkStart, linkEnd))
+    offset = linkEnd + 1
+  }
+  return links
+}
+
 for (const file of files) {
   const content = readFileSync(file, 'utf8')
   const dir = dirname(file)
 
-  const linkPattern = /\[([^\]]*)\]\(([^)]+)\)/g
-  let match
-  while ((match = linkPattern.exec(content)) !== null) {
-    const href = match[2].split('#')[0].split('?')[0]
+  for (const link of extractMarkdownLinks(content)) {
+    const href = link.split('#')[0].split('?')[0]
     if (!href) continue
     if (href.startsWith('http') || href.startsWith('//') || href.startsWith('mailto:')) continue
     if (!href.endsWith('.md') && !href.includes('/')) continue

docs-site/scripts/fetch-typedoc.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { execSync } from 'child_process'
-import { existsSync, mkdirSync, rmSync } from 'fs'
+import { execFileSync } from 'child_process'
+import { cpSync, existsSync, mkdirSync, rmSync } from 'fs'
 import { resolve, dirname } from 'path'
 import { fileURLToPath } from 'url'
 
@@ -14,24 +14,24 @@ if (!existsSync(DIST)) {
   process.exit(0)
 }
 
-function run(cmd, opts = {}) {
-  console.log(`$ ${cmd}`)
-  execSync(cmd, { stdio: 'inherit', cwd: ROOT, ...opts })
+function run(command, args, opts = {}) {
+  console.log(`$ ${[command, ...args].join(' ')}`)
+  execFileSync(command, args, { stdio: 'inherit', cwd: ROOT, ...opts })
 }
 
 try {
   if (existsSync(TMP)) rmSync(TMP, { recursive: true })
   mkdirSync(TMP, { recursive: true })
 
-  run('git fetch origin gh-pages --depth=1')
+  run('git', ['fetch', 'origin', 'gh-pages', '--depth=1'])
 
   try {
-    run(`git --work-tree="${TMP}" checkout origin/gh-pages -- api/`)
+    run('git', ['--work-tree', TMP, 'checkout', 'origin/gh-pages', '--', 'api/'])
     const apiSrc = resolve(TMP, 'api')
     const apiDst = resolve(DIST, 'api')
     if (existsSync(apiSrc)) {
       if (existsSync(apiDst)) rmSync(apiDst, { recursive: true })
-      run(`cp -R "${apiSrc}" "${apiDst}"`)
+      cpSync(apiSrc, apiDst, { recursive: true })
       console.log('TypeDoc /api/ merged into dist/')
     } else {
       console.log('No api/ directory in gh-pages — skipping')

docs-site/src/components/Mermaid.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useRef, useState } from 'react'
+import { useEffect, useId, useRef, useState } from 'react'
 import styles from './Mermaid.module.css'
 
 interface Props {
@@ -7,6 +7,7 @@ interface Props {
 
 export default function Mermaid({ code }: Props) {
   const ref = useRef<HTMLDivElement>(null)
+  const renderId = useId().replaceAll(':', '')
   const [error, setError] = useState<string | null>(null)
 
   useEffect(() => {
@@ -35,7 +36,7 @@ export default function Mermaid({ code }: Props) {
         fontFamily: "'JetBrains Mono', monospace",
       })
 
-      const id = 'mermaid-' + Math.random().toString(36).slice(2)
+      const id = `mermaid-${renderId}`
       mermaid
         .render(id, code)
         .then(({ svg }) => {

docs-site/src/components/SearchBox.module.css

@@ -80,7 +80,6 @@
 }
 
 .resultExcerpt {
-  display: block;
   font-size: 0.8rem;
   color: var(--dev-text-dim);
   line-height: 1.4;