# Project plan — codescanner

Evidence date: 2026-10-18.

Source repository: `git@bitbucket.org:overdrive/codescanner.git`.

This plan describes what that repository contains. It does not decide what the toolkit should become.

The scan-host path named on the onboarding issue (`~/projects/sonar_scan/repos/codescanner`) is not present on the machine that produced this document. Evidence is a clone of `origin/master`. Untracked files that existed only on the scan host were not available to read.

## Product

**codescanner** is an internal Windows toolkit for running SonarScanner against a SonarQube server on EC2. It is not an application with its own users, database, or screens.

The only product description in the tree is `snippets.txt`. `readme.md` exists and is empty (0 bytes).

| Identity found in the tree | Where |
|---|---|
| Clone URL `https://bitbucket.org/overdrive/codescanner.git` | `snippets.txt` setup step 1 |
| SonarScanner CLI jar name `sonar-scanner-cli-4.6.2.2472.jar` | `sonar-scanner.bat` and `sonar-scanner/bin/sonar-scanner.bat` |
| AdoptOpenJDK JRE 11.0.11+9, Windows x86_64 | `sonar-scanner/jre/release` |
| SonarQube UI check URL `http://79.125.106.230/sessions/new` | `snippets.txt` |
| Scanner host URL `http://79.125.106.230` | the five saved scan commands in `snippets.txt` |
| EC2 instance `i-009462d8c9b182d5a` | `start.cmd`, `stop.cmd` |
| Example launch: AMI `ami-005ec3d100c64ab37`, type `t3a.medium`, region `eu-west-1`, profile `unity` | `snippets.txt` Extra |

Provenance of those rows: **Documented** in the named files. Whether the instance, the address, and the AMI still match a running server is **Unknown / Requires Confirmation**.

## Branch reality

`git ls-remote --heads` on 2026-10-18 returned one head:

| Branch | Tip | Date | Subject |
|---|---|---|---|
| `master` | `dc201f67859ee649a7f033194f116479c99aad00` | 2021-07-14 14:08:34 +0200 | Update snippets |

Author of all three commits: Jaco Brits (`jaco@overdrive.co.za`).

| Commit | Date | What it contains |
|---|---|---|
| `f3e7458` | 2021-07-14 11:41:25 +0000 | `.gitignore` only. The file is the Bitbucket sample ignore list, including `*.jar` and `*.exe` |
| `2f01cda` | 2021-07-14 13:44:32 +0200 | Empty `readme.md`, `snippets.txt`, both scanner batch files, `sonar-scanner/` (scripts, properties, JRE config and the `modules` image), `sonarqubekey.pem`, `start.cmd`, `stop.cmd` |
| `dc201f6` | 2021-07-14 14:08:34 +0200 | `snippets.txt` only: clone URL without the `jacooverdrive@` user, a separator line, and one more saved scan (`1fortheroadPWA`) |

There is no later commit. No milestone list, roadmap, or issue tracker is in the repository.

The onboarding issue (captured 2026-09-28) listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `dc201f6`. Provenance: **Unknown**. They may have been untracked files on the scan host.

## Scope in the repository

In scope of what is committed on `master`:

- A written setup and a list of scan commands already used (`snippets.txt`).
- A Windows launcher that expects SonarScanner to live at `C:\sonar-scanner` and that calls SonarScanner CLI 4.6.2.2472 (`sonar-scanner.bat`).
- The upstream scanner's `bin` scripts, default `conf/sonar-scanner.properties`, and a partial AdoptOpenJDK 11 JRE under `sonar-scanner/`.
- Two AWS CLI wrappers that start and stop one EC2 instance (`start.cmd`, `stop.cmd`).
- An RSA private key file (`sonarqubekey.pem`) that no script references.

Out of scope of the committed tree, or not present as runnable pieces:

- The SonarQube server itself. This repo only points at it and starts or stops an instance id.
- The application source that gets scanned. The five project keys are command lines, not source trees.
- `sonar-scanner-cli-4.6.2.2472.jar`, `java.exe`, and JRE native libraries. `.gitignore` excludes `*.jar` and `*.exe`, and those files are not in git. A checkout of `master` cannot start a scan by itself.
- Tests, CI, a database, an HTTP API, and a user interface owned by this repository.
- Any change after 2021-07-14.

## Architecture

```text
Operator PC (Windows)
  snippets.txt          runbook and saved scan commands
  sonar-scanner.bat     copied into a target repo; hardcoded home C:\sonar-scanner
  C:\sonar-scanner\     expected install location (setup step 2)
        bin\            upstream launcher (relative home)
        conf\           defaults commented out
        jre\            AdoptOpenJDK 11 metadata and modules image; no java.exe in git
        lib\            expected jar path; directory is absent from git
  start.cmd / stop.cmd  aws ec2 start-instances / stop-instances

AWS eu-west-1 (documented on the example launch only)
  instance i-009462d8c9b182d5a
  SonarQube UI and scanner endpoint http://79.125.106.230
```

The example `aws ec2 run-instances` line is notes. `start.cmd` and `stop.cmd` do not pass `--region` or `--profile`. Provenance: **Implemented** in those two files. Whether the caller's AWS CLI defaults are `eu-west-1` and `unity` is **Unknown / Requires Confirmation**.

## Major components

| Component | Role | Evidence |
|---|---|---|
| `snippets.txt` | Setup steps, server check, links, five saved scans | **Documented** |
| Root `sonar-scanner.bat` | Launcher meant to be copied into a code root. `SONAR_SCANNER_HOME=C:\sonar-scanner\bin\..` | **Implemented** |
| `sonar-scanner/bin/sonar-scanner.bat` | Same launcher with home derived from the script directory | **Implemented** |
| `sonar-scanner/bin/sonar-scanner-debug.bat` | JDWP debug on port 8000, then calls the bin launcher | **Implemented**. Not mentioned in `snippets.txt` |
| `sonar-scanner/conf/sonar-scanner.properties` | Commented defaults (`localhost:9000`, `UTF-8`). Does not set the Overdrive host | **Implemented** |
| `sonar-scanner/jre` | Embedded JRE metadata. `use_embedded_jre=true` in both launchers | **Implemented** |
| `start.cmd` / `stop.cmd` | Start or stop instance `i-009462d8c9b182d5a` | **Implemented** |
| `sonarqubekey.pem` | RSA private key, 1704 bytes, added in `2f01cda` | **Implemented** as a file. Purpose **Unknown** |

## Milestones and implementation plan

No milestone or implementation plan is written in the repository.

What the history shows:

1. `f3e7458` — repository created with a sample `.gitignore`.
2. `2f01cda` — scanner tree, runbook, instance start/stop, and the private key added the same day.
3. `dc201f6` — runbook URL cleaned up and a fifth saved scan appended, about 24 minutes later.

Nothing in git describes work after that day. Current project status: **dormant on `master` since 2021-07-14**. Whether anyone still uses the toolkit from a machine that has the missing jar and JRE binaries is **Unknown / Requires Confirmation**.

## Known dependencies

| Dependency | How this repo uses it | Provenance |
|---|---|---|
| SonarQube | UI liveness URL and `sonar.host.url` on every saved scan | **Documented** |
| SonarScanner CLI 4.6.2.2472 | Classpath jar name in both `.bat` files. The jar is not in git | **Implemented** name. Binary **absent** |
| AdoptOpenJDK 11.0.11+9 Windows x64 JRE | `sonar-scanner/jre/release`. `java.exe` is not in git | **Implemented** metadata. Binary **absent** |
| AWS CLI | `aws ec2 start-instances` / `stop-instances` / example `run-instances` | **Documented** and **Implemented** in the cmd files |
| EC2 instance `i-009462d8c9b182d5a` | The only instance id in the scripts | **Implemented** |
| AWS profile `unity`, region `eu-west-1` | Example launch line only | **Documented**. Not set by `start.cmd` or `stop.cmd` |

External pages named in `snippets.txt` and not fetched for this onboarding:

- `https://www.baeldung.com/linux/aws-cli-ec2`
- `https://bitnami.com/stack/sonarqube/cloud/aws/amis`

The Bitnami page sits next to the AMI id. The file does not say that `ami-005ec3d100c64ab37` is that Bitnami image. That link is **Unknown / Requires Confirmation**.

## Current status

| Item | State on 2026-10-18 |
|---|---|
| Silicon Ark docs for this project | Created by this onboarding. No earlier `codescanner/` directory was in `silicon_ark` |
| Source repo | One branch, `master`, tip `dc201f6`, last change 2021-07-14 |
| Runnable scanner from git alone | No. Jar and `java.exe` are gitignored and absent |
| Server still up, tokens still valid, instance still that id | **Unknown / Requires Confirmation** |

## Human confirmation

1. Is EC2 instance `i-009462d8c9b182d5a` still the SonarQube host, and does `http://79.125.106.230` still serve it?
2. `snippets.txt` contains an admin password and a `sonar.login` token on each saved scan. Those values are not copied into Silicon Ark. Should they be rotated and removed from git history?
3. What is `sonarqubekey.pem` for? No script reads it. Should the private key leave the repository?
4. Did `sonar-project.properties` and `sonarqube_scan.bat` exist only as untracked files on the scan host?
5. Do operators keep `sonar-scanner-cli-4.6.2.2472.jar` and the JRE `bin`/`lib` binaries outside git?
6. Setup step 4 says to create a project with a random key. The saved commands use readable keys (`TMTFrontend`, `TMTBackend`, `MyPassRegistration`, `MyPassPWA`, `1fortheroadPWA`). Which practice is current?
7. Should `start.cmd` and `stop.cmd` pass `--region eu-west-1` and `--profile unity`, as the example launch line does?
8. Are the five saved scans the current project set, or a historical note from 2021-07-14?
9. The runbook says to ask Jaco if the server is down. Is that still the operating rule, and who else may start the instance?