chore: 🤖 resolve SonarCloud quality gate failures

[prashantasdeveloper]

Resolves the SonarCloud Quality Gate failure reported on master (check run 105569982946).

Failing conditions, all addressed: C Security Rating on New Code, 40 Code Smells, 3 New Code Smells, 66.7% Security Hotspots Reviewed, C Security Review Rating — 46 issues + 1 unreviewed hotspot, pulled from the SonarCloud API.

Security — S6505, 6 issues

CI installs ran yarn --immutable, which executes dependency lifecycle scripts.

The obvious fix (--mode=skip-build) would have broken the build, so it was verified against a scratch Yarn 4 project first: --mode=skip-build also suppresses the root postinstall — the script that dedupes @polkadot for the SDK. Each install is therefore now two steps:

- run: yarn --immutable --mode=skip-build   # dependency scripts blocked
- run: yarn run postinstall                 # our own trusted script still runs

Verified end-to-end from a clean node_modules: install → postinstall → lint → build → test all pass. (Note: with the current lockfile those nested @polkadot copies are no longer created at all, so postinstall is currently a defensive no-op.)

The same treatment is applied to scripts/integration-test.sh, where the yarn call installs the cloned polymesh-dev-env test harness — that package has no postinstall, so no follow-up step is needed there.

Security hotspot

sequoia-pgp/fast-forward@v1 is pinned to ea7628b. The v1 branch, the v1.0.0 tag and that SHA are all the same commit, so behavior is unchanged.

Code smells

• Mark never-reassigned members readonly (currentId is left mutable — it is a counter)
• node: protocol imports, Number.isNaN / Number.parseInt, Date.now(), Array.prototype.flatMap over lodash flatten
• Avoid an object literal as a default parameter in ApiArrayResponse
• String.raw for the regex literals in jest.config.js
• Sort the Dockerfile apk packages; [[ ]] in the shell scripts; explicit return in the integration-test cleanup trap
• Extract cloneRepo / buildAndPushImage out of the Jenkinsfile node block to keep control-flow nesting within 3 levels

One real bug

subscriptions.service.spec.ts called expect(...) with no matcher, so the batchBumpNonce test asserted nothing and passed unconditionally. Completing the assertion made it fail — findAll() is not stubbed in that block and returned a bare mock. Rewritten to assert the actual delegation to incrementNonces, matching the adjacent batchMarkAsDone test.

Reviewer note — 9 smells suppressed, not code-fixed

The *.repo.spec.ts files Sonar reports as having no tests (S2187) do run real tests — they delegate to shared suites (NotificationRepo.test(repo)) whose it blocks live in *.repo.suite.ts and which Sonar's static analysis cannot see through. Deleting them would delete real coverage, so sonar-project.properties ignores S2187 for those paths.

This project uses SonarCloud Automatic Analysis (there is no scanner step in CI), so please confirm the gate actually honours sonar.issue.ignore.multicriteria. If those 9 still report, the fallback is marking them "Won't Fix" in the SonarCloud UI.

Verification

yarn lint, yarn build clean. 1087/1087 tests pass across 105 suites.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud