# Business rules — go_api

Evidence date: 2026-10-13.

Source: `git@bitbucket.org:overdrive/go_api.git`, `master` at `366442a` (2023-09-18). Full hash `366442ae98ef4d7180c587e01ebb2fdbe09c1fe5`.

No business-rules document exists in the source repository. The tree has no application code, so there are no domain rules for users, requests, responses, pricing, or permissions. The rules below are the constraints the committed pipeline, properties file, and ignore file actually state. Anything marked **Inferred** is a conclusion from that evidence, not a written policy.

## Pipeline selection

### BR-001 — The defined pipeline runs for the branch pattern `{master}` only

**Implemented.**

`bitbucket-pipelines.yml` sets `pipelines.branches` with the key `{master}`. It does not set `pipelines.default` or `pipelines.pull-requests`.

The only branch in the repository is `master`. A brace list is how this file names that branch. Whether a live Bitbucket run selects `master` from `{master}` was not executed here. Provenance of the key: **Implemented**. Provenance of the match: **Inferred** from Bitbucket's documented brace patterns.

Evidence: `bitbucket-pipelines.yml`.

### BR-002 — The only step is a SonarQube analysis

**Implemented.**

The file defines one step, named "SonarQube analysis", and the `{master}` pipeline runs that step. There is no build step before it and no publish step after it.

There is no `fail-fast` override, manual trigger, or condition. What the pipe does when the scanner fails, and whether a quality gate can fail the build, is not written in this file. Provenance of a gate: **Unknown**.

## Sonar identity and secrets

### BR-003 — The Sonar project key is fixed in the repository

**Implemented.**

```text
sonar.projectKey=overdrive_go_api_AYqpslFAuNwRc2P2S9SL
```

No other Sonar property is set. Sources, exclusions, host, and project name are not in git. The scanner's defaults for those, on whatever server the token reaches, are **Unknown / Requires Confirmation**.

Evidence: `sonar-project.properties`.

### BR-004 — The Sonar host and token come from pipeline variables

**Implemented** as variable references. **Documented** in the inline comments.

The pipe reads `SONAR_HOST_URL` and `SONAR_TOKEN`. The comments say to take each value from the repository or workspace variable, and that the token should not be set in clear text. The file does not contain a URL or a token.

Whether those variables are configured, and on which Sonar server, is **Unknown / Requires Confirmation**.

### BR-005 — Analysis uses a full clone

**Implemented.**

`clone.depth` is `full`. No shallow-clone exception is written. A reason is not written in the file. **Inferred:** the Sonar scanner uses history for blame, which a shallow clone would cut off. That purpose is not stated in the repository.

## What the image does not decide

### BR-006 — The pipeline image is Maven 3.3.9, and Maven is not invoked

**Implemented** image. **Implemented** absence of a Maven command.

`image: maven:3.3.9` applies to the file. No step overrides it. The script is only the Sonar pipe. There is no `pom.xml`, no `mvn` line, and no Maven cache.

This is not a rule that the product is a Java application. Provenance of a Java stack: **Unknown**. It is also not a rule that the product is a Go API. The script does not call `go`.

## What the ignore file does not decide

### BR-007 — The ignore list is the stock template

**Implemented.**

`.gitignore` is the example file Bitbucket adds at repository creation. The header says to customize it. Commit `14e18c6` added it. Later commits did not change it.

It ignores `node_modules/`, `dist/`, Java class files, Python bytecode, logs, jars, Maven `target/`, `.idea/`, `TEST*.xml`, OS junk, `*.exe` / `*.war` / `*.app`, and several media types. It does not ignore `.env`. It does not ignore `sonar-project.properties`. It does not add Go-specific paths.

This is not a business rule about which languages the product uses. Provenance of a stack choice: **Unknown**. The repository name is not evidence of a Go module.

## Rules that were not found

No evidence in this repository for:

- User roles, authentication, or authorization of an application.
- API routes, request validation, status codes, or response shapes. The repository name contains "api". No API exists in git.
- Data validation, uniqueness, or required fields.
- Pricing, tax, or billing.
- Retention, audit, or privacy rules.
- A SonarQube quality gate, source path, or exclusion. The project key is the only Sonar setting in git.
- A local scan command. The scan-host name `sonarqube_scan.bat` is not in git.
- A production or QA deploy target. The pipeline does not publish anywhere except the Sonar server named by `SONAR_HOST_URL`.
- Retry, approval, or rollback.