Feature dtcenter/METplus-Internal#68 SonarQube Blockers

[JohnHalleyGotway]

Summary of Changes

Works through SonarQube static-analysis findings for MET (dtcenter/METplus-Internal#68), prioritizing Blocker/Critical severity and genuine correctness ("Reliability") issues over pure style.

Bug fixes found along the way

Several findings turned out to be pointing at real bugs, not just style:

• ThreshArray::check_bins() — a variable-shadowing bug left the function returning an uninitialized stack value instead of the computed bin index, causing grid_stat to crash with a contingency-table range-check error. Fixed alongside a related check_prefix_suffix() bug that called regcomp() with an empty pattern (silently tolerated on Linux, rejected on macOS).
• CRC_Array<T>::sum() (backs IntArray/BoolArray) — the identical shadowing pattern, causing sum() to read an uninitialized count and return garbage for the empty-array case.
• MM_Engine (mode_time_domain) — a manually-managed int* member (comp_to_eq) could be read before being sized to match what was actually written into it. Converted to IntArray (RAII), removing the raw new/delete bookkeeping.
• point2grid.cc (regrid_nc_variable()) — a debug log message could report the wrong source data offset, since it reused a loop variable (from_index) holding the last checked index rather than the contributing one.
• track_info.cc (TrackInfo::add()) — added an explicit bounds check on an array write; the invariant already held in practice, but wasn't provable across a private-method call boundary.

Move-semantics modernization

Gave several hand-rolled container classes (ConcatString, StringArray, NumArray, IntArray, TimeArray, ThreshArray, CRC_Array<T>, Shp_Array<T>, NCRR_Array<T>, SingleThresh, VxPairDataPoint) proper noexcept move constructors/assignment operators, or reimplemented them on std::vector — resolving a large class of "moving an object is not noexcept" findings.

Style / best-practice cleanup

Addressed a long tail of findings: excessive nesting, variable shadowing, redundant multi-variable declarations, 0/NULL vs. nullptr, protected vs. private data members, operator== converted to a hidden friend, raw new/delete replaced with RAII containers, and similar.

Excluded generated code from analysis

Bison-generated parser files (config.tab.cc, color_parser_yacc.cc, enum_parser.cc) contain goto-based state machines intrinsic to bison's own parser skeleton — not something a grammar file can avoid. Added sonar.exclusions for these rather than chasing an unfixable finding.

CI / developer tooling

• Fixed the SonarQube GitHub Actions job so a failed compile can no longer silently register as scan "success" (it wasn't checking the build's return status).
• report-task.txt now included in the workflow's log artifact.
• Added internal/scripts/sonarqube/fetch_sonarqube_findings.sh, a local developer tool that pulls findings from the SonarQube Web API (working around its 10,000-result pagination cap by splitting queries by severity/type) and rate-limits requests to avoid overloading the shared server. Deliberately not wired into CI — findings shouldn't land in a public repo's workflow artifacts.

Testing

• Full MET regression suite (make test) passes.
• mode_time_domain and point2grid aren't covered by that suite; both were additionally verified with direct end-to-end runs against real sample data.

Expected Differences

• Do these changes introduce new tools, command line arguments, or configuration file options? [No]
  
  If yes, please describe:
  

• Do these changes modify the structure of existing or add new output data types (e.g. statistic line types or NetCDF variables)? [No]
  
  If yes, please describe:
  

Pull Request Testing

• Describe testing already performed for these changes:
  

• Ran the SonarQube scan several times to confirm that all blockers in MET have been addressed.

• Recommend testing for the reviewer(s) to perform, including the location of input datasets, and any additional instructions:
  

• Ensure that testing workflow flags no differences in the output.

• Check the SonarQube scan results to confirm that the

• Do these changes include sufficient documentation updates, ensuring that no errors or warnings exist in the build of the documentation? [Yes]

• None needed

• Do these changes include sufficient testing updates? [Yes]

• No new tests needed. Use existing.

• Will this PR result in changes to the MET test suite? [No]
  
  If yes, describe the new output and/or changes to the existing output:
  

• Will this PR result in changes to existing METplus Use Cases? [No]
  
  If yes, create a new Update Truth METplus issue to describe them.

• Do these changes introduce new SonarQube findings? [No]
  
  If yes, please describe:

• As of this pull request, 14,082 SonarQube issues are flagged in the develop branch. These include 1 "Reliability" issue and 20 "Blockers".

• This pull request reduces that by 401 to 13,681 issues with 0 reliability issues and 0 blockers.

Warning

6 of 20 "Blocker" issues are now just ignored. This PR modifies sonar-project.properties to NOT SCAN code that is automatically generated by bison. The resulting goto statements still exist in the output and cannot be removed. Recommend that the USAF use a similar setting to avoid scanning code generated by bison.

• Please complete this pull request review by [Wed Sept 16, 2026].
  

Pull Request Checklist

See the METplus Workflow for details.

• Review the source issue metadata (required labels, projects, and milestone).
• Complete the PR definition above.
• Ensure the PR title matches the feature or bugfix branch name.
• Define the PR metadata, as permissions allow.
  Select: Reviewer(s) and Development issue
  Select: Milestone as the version that will include these changes
  Select: METplus-X.Y Support project for bugfix releases or MET-X.Y Development project for the next coordinated release
• After submitting the PR, select the ⚙️ icon in the Development section of the right hand sidebar. Search for the issue that this PR will close and select it, if it is not already selected.
• After the PR is approved, merge your changes. If permissions do not allow this, request that the reviewer do the merge.
• Close the linked issue and delete your feature or bugfix branch from GitHub.

[sonarqubecloud]

Quality Gate passed

Issues
21 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud