Add a local SonarCloud check; simplify AdjustForContrast; cover PatternValidationRule

[matt-edmondson]

Three things: a workflow fix, one S3776 refactor, and closing the coverage gap that failed #161's gate.

A local SonarCloud check

CI injects the Sonar analyzers via the scanner, so a plain dotnet build never runs them — findings only surface after a push, a ~10 minute round trip per attempt. This session spent a lot of time on exactly that loop. Ported the opt-in from KtsuBuild:

dotnet build -p:CustomBeforeMicrosoftCommonProps=$PWD/.sonarlint/sonar-local.props

.sonarlint/sonar-local.globalconfig raises the rules CI reports that the analyzer package ships disabled, and silences the ones CI's profile does not report, so a clean local run means a clean CI run. Nothing imports it automatically — normal builds, CI and packaging are unaffected. Documented in CLAUDE.md.

Known limitation, stated up front: it currently only reaches Semantics.SourceGenerators. That project declares its SDK with the <Project Sdk="..."> attribute form, whereas the ktsu.Sdk projects use <Project> with <Sdk Name="..." /> elements, and CustomBeforeMicrosoftCommonProps does not reach those. Findings in Strings, Paths, Music, Color and Quantities still have to be read from SonarCloud. Worth solving properly in the SDK — probably a Directory.Build.props hook gated on a property — but that belongs in ktsu.Sdk rather than here.

Even limited to one project it is useful: Semantics.SourceGenerators holds 7 of the 9 remaining S3776 findings and most of the remaining S1192.

S3776 — AdjustForContrast (complexity 19)

Two changes, both of which also remove duplication:

• The WCAG thresholds were written out twice — a switch here and a pair of ternaries in AccessibilityLevelAgainst. Both now call a shared RequiredContrast(level, largeText).
• The binary search had a four-way branch. The interval always shrinks toward the end that satisfies the requirement, and when darkening the roles simply swap, so it reduces to one comparison:

if (meets == goLighter) { hi = mid; } else { lo = mid; }

Coverage — PatternValidationRule

This is what failed #161's new_coverage condition: the class had no tests at all, which matters more now that it carries a regex match timeout. Added six, including one that proves the hardening works rather than assuming it:

PatternValidationRule rule = new("^(a+)+$");          // classic catastrophic backtracking
Assert.ThrowsExactly<RegexMatchTimeoutException>(() => rule.Validate(value));

Without the timeout added in #161 that call does not finish in any practical time. So the S6444 fix is now verified, not asserted.

Verification

• dotnet build — 0 errors, 0 warnings, all target frameworks
• dotnet test — 1095/1095 pass

Remaining — ~48

S3776 ×7 (all in Semantics.SourceGenerators, now locally checkable — QuantitiesGenerator has two at complexity 42 and 43, DimensionsMetadata one at 41), S1133 ×10, S1192 ×15, S4136 ×8 in SemanticString.cs, S1172 ×4, S3267 ×4, S2342 ×2, S4144 ×1.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
87.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud