# Business rules — codescanner

Evidence date: 2026-10-18. Revision: `master` `dc201f67859ee649a7f033194f116479c99aad00`.

This repository is a scanner toolkit and a runbook. It has no application domain objects, no database, and no permission code. Rules below are the ones the runbook states or the scripts enforce. Nothing here is a new product decision.

Labels:

- **Documented** — written in `snippets.txt`.
- **Implemented** — what a script does.
- **Inferred** — a reasonable reading that the file does not state.

Passwords, `sonar.login` tokens, and the PEM body are not copied into this document.

## BR-PURPOSE — What the toolkit is for

The operator uses the repo to run SonarScanner against the server at `http://79.125.106.230`, and uses `start.cmd` / `stop.cmd` to start or stop EC2 instance `i-009462d8c9b182d5a`.

Provenance: server URL and the scan steps are **Documented**. The instance id in the scripts is **Implemented**. The sentence that those scripts are how the named server is started is **Inferred**: the runbook says to ask Jaco to start the instance, and these are the only start/stop scripts.

## BR-SETUP — Where the scanner must live

1. The operator clones `https://bitbucket.org/overdrive/codescanner.git`. Provenance: **Documented**. The previous commit used `https://jacooverdrive@bitbucket.org/overdrive/codescanner.git`. That user prefix was removed in `dc201f6`.
2. `sonar-scanner` is copied to the PC root. The example is `c:/sonar-scanner`. Provenance: **Documented**.
3. The root `sonar-scanner.bat` always sets `SONAR_SCANNER_HOME` to `C:\sonar-scanner\bin\..`. A copy placed in a project still uses `C:\sonar-scanner`, not a path next to the project. Provenance: **Implemented**.
4. The bat that lives in `sonar-scanner/bin/` sets home from its own directory. Provenance: **Implemented**. The runbook does not tell the operator to run that file.
5. Setup step 3 says to copy `sonar-scanner.bat` into the "code route database". Provenance: **Documented** wording. Treating that as the root of the repository being scanned is **Inferred** from step 5 ("Run CLI command in Code root, where sonar-scanner.bat is").

## BR-SCAN — How a scan is identified

1. A project is created in SonarQube with a name and a key before the CLI is run. Provenance: **Documented**.
2. The written step says the key is random. Provenance: **Documented**.
3. The five saved commands use readable keys: `TMTFrontend`, `TMTBackend`, `MyPassRegistration`, `MyPassPWA`, `1fortheroadPWA`. Provenance: **Documented**.
4. Rules 2 and 3 disagree. Which one a new project must follow is **Unknown / Requires Confirmation**.
5. Every saved command sets `sonar.sources=.` (the working directory), `sonar.host.url=http://79.125.106.230`, and `sonar.login` to a token. Provenance: **Documented**.
6. The launcher does not require those properties. It appends `%*` to the Java command. A scan with no arguments still starts the scanner main class. Provenance: **Implemented**.
7. `sonar-scanner/conf/sonar-scanner.properties` does not set the Overdrive host. Both `sonar.host.url` and `sonar.sourceEncoding` are comments. Provenance: **Implemented**. Scans are not allowed to rely on that file for the server address. That limit is **Inferred** from the comments ("No information about specific project should appear here") and from the fact that every saved command passes the host on the CLI.
8. Branch notes exist only as words in the labels ("Master Branch", "Prod branch", "Master BranchConn"). No command passes `sonar.branch.name` or a similar property. Provenance: **Documented** labels. A rule that the scanner checks out those branches was **not found**.

## BR-RESULTS — Where results go

The scripts do not write a report file. Exit status is 0, or 1 when Java is missing or the scanner process returns an error level. Provenance: **Implemented** (`ERROR_CODE` in both `sonar-scanner.bat` files).

Scan findings are left on the SonarQube server. A local quality gate, a failure threshold, or a required SonarQube quality profile was **not found**.

## BR-SERVER — When the server is considered down

1. The operator opens `http://79.125.106.230/sessions/new`. Provenance: **Documented**.
2. If the server is not alive, the operator asks Jaco to start the instance. Provenance: **Documented**.
3. The file does not define the HTTP status, page title, or timeout that counts as "not alive". Provenance: **Unknown**.
4. No script performs this check before `start.cmd`, `stop.cmd`, or a scan. Provenance: **Implemented** absence.

## BR-INSTANCE — Which machine the scripts control

1. `start.cmd` may only name instance `i-009462d8c9b182d5a`, and only the start-instances action. Provenance: **Implemented**.
2. `stop.cmd` may only name that same id, and only the stop-instances action. Provenance: **Implemented**.
3. Neither script passes `--region` or `--profile`. Provenance: **Implemented**.
4. The notes show a launch of a new instance: AMI `ami-005ec3d100c64ab37`, type `t3a.medium`, region `eu-west-1`, profile `unity`. Provenance: **Documented**. That command is not the start script. Running it would request a new instance rather than start `i-009462d8c9b182d5a`.
5. A rule that start/stop must use region `eu-west-1` and profile `unity` was **not found** in the scripts. Whether the operator's AWS defaults supply them is **Unknown / Requires Confirmation**.
6. There is no schedule, no idle timeout, and no "stop after scan" step. Provenance: absence **Implemented**.

## BR-WHO — Who may act

1. The runbook names one person, Jaco, and only for starting the instance when the UI is down. Provenance: **Documented**.
2. `start.cmd` and `stop.cmd` do not check who is running them. Anyone with a working AWS CLI and permission for that instance id can run them. Provenance: **Implemented**.
3. The SonarQube UI username written in the runbook is `admin`. A password is stored in the same paragraph. Provenance: **Documented**. The password is omitted here. A rule that restricts who may use that account was **not found**.
4. Scanner authentication is a per-command token, not a user role in this repo. Provenance: **Documented**.
5. Whether those tokens are project-scoped analysis tokens or a shared credential is **Unknown / Requires Confirmation**. The file does not say.

## BR-SECRETS — What must not be treated as safe to copy

1. `snippets.txt` stores the admin password and five `sonar.login` values in clear text, and git history retains the four tokens from `2f01cda` as well as the fifth from `dc201f6`. Provenance: **Implemented** (they are in the committed file).
2. `sonarqubekey.pem` is a PKCS#1 RSA private key (`BEGIN RSA PRIVATE KEY`), 1704 bytes, mode 100644, added in `2f01cda`. Provenance: **Implemented**.
3. No script, properties file, or runbook line references `sonarqubekey.pem`. Provenance: **Implemented** absence of a reference.
4. The filename is the only hint that the key belongs to the SonarQube host. That reading is **Inferred**. Confirming it needs a human.
5. This knowledge set does not repeat the password, the tokens, or the key body.

## BR-TRANSPORT — How the PC talks to SonarQube

Saved commands and the liveness URL use `http`, not `https`, and they do not set a port. Provenance: **Documented**.

A requirement to keep HTTP, or to put a TLS certificate in front of the server, was **not found**.

## BR-JAVA — Which Java runs the scanner

1. `use_embedded_jre=true` is hardcoded in both launchers. Provenance: **Implemented**.
2. That flag sets `JAVA_HOME` to `%SONAR_SCANNER_HOME%\jre` and expects `%JAVA_HOME%\bin\java.exe`. Provenance: **Implemented**.
3. The committed JRE identifies itself as AdoptOpenJDK 11.0.11+9, Hotspot, Windows x86_64, image type JRE (`sonar-scanner/jre/release`). Provenance: **Implemented**.
4. `jre/bin` is not in the commit, so `java.exe` is absent. `.gitignore` ignores `*.exe`. Provenance: **Implemented**.
5. If the embedded java.exe is missing, the launcher prints an error and exits 1. It does not fall through to a `PATH` java, because the embedded flag forces `JAVA_HOME` first. Provenance: **Implemented**.
6. Optional `SONAR_SCANNER_OPTS` and `SONAR_SCANNER_DEBUG_OPTS` are passed to the JVM when set in the environment. Provenance: **Implemented** (header comments and the Java command line). The runbook does not set them.

## BR-DEBUG — Debug listener

`sonar-scanner/bin/sonar-scanner-debug.bat` opens a JDWP socket on port 8000 and suspends until a debugger attaches (`suspend=y`). Provenance: **Implemented**.

The runbook does not authorise or forbid this. It is upstream scanner behaviour sitting in the tree. No Overdrive rule was found.

## BR-IGNORE — What git will not store

`.gitignore` is the sample Bitbucket ignore file from `f3e7458`. It ignores `*.jar`, `*.exe`, `*.class`, logs, `node_modules/`, Maven `target/`, and IDE files, among other patterns. Provenance: **Documented** as a sample list ("You should customize this list"). **Implemented** as the ignore rules in force.

Effect on this repo: the scanner CLI jar and the JRE executables are not in `dc201f6`. A rule that says "ship a runnable scanner inside git" was **not found**. The opposite effect is what the ignore file does.

## BR-NOT-FOUND — Rules that are easy to assume and are not in the tree

The following were looked for and not found. They are not silent requirements.

- A quality gate that must pass before a change is accepted.
- A list of languages, exclusions, or test directories (`sonar.tests`, `sonar.exclusions`).
- Coverage, CI, or a Bitbucket Pipeline.
- An authentication check inside `start.cmd` or `stop.cmd`.
- A retention period for SonarQube projects.
- A mapping from project key to a Bitbucket repository, other than the prose labels in `snippets.txt`.
- Use of `sonarqubekey.pem` as an SSH key, an AWS key, or a SonarQube key. The file type is a private key. The purpose is **Unknown / Requires Confirmation**.