# PRD — go_api Evidence date: 2026-10-13. Source: `git@bitbucket.org:overdrive/go_api.git`, `master` at `366442a` (2023-09-18). Full hash `366442ae98ef4d7180c587e01ebb2fdbe09c1fe5`. There is no prior PRD in the source repository or in Silicon Ark. The repository has no README and no application. Requirements below are recovered from `.gitignore`, `sonar-project.properties`, and `bitbucket-pipelines.yml`. Provenance is labelled. Pipeline secret values are not in git. ## Product purpose **Unknown.** Nothing in the repository states what go_api does, who uses it, or which problem it solves. **Implemented.** The repository holds a default ignore file, a SonarQube project key, and a Bitbucket Pipelines definition that runs `sonarsource/sonarqube-scan:2.0.1`. **Unknown / Requires Confirmation:** whether this repository is an unstarted Go API, a Sonar-only placeholder, or the scan hook for source that lives somewhere else. The slug is the only place the words "go" and "api" appear, apart from the same words inside the Sonar project key. ## Users and roles | Actor | Evidence | Status | |---|---|---| | Repository author | All three commits, Jaco Brits (`jaco@overdrive.co.za`) | **Implemented** as git history only | | Pipeline / Sonar operator | Variables `SONAR_HOST_URL` and `SONAR_TOKEN` | **Inferred** from the pipe variables. No user interface | | End user of an API | No screen, route, handler, or role in the tree | **Unknown** | No login, session, permission, or role check exists. ## Systems the product talks to The pipeline, if it ran, would talk to: 1. Bitbucket Pipelines, using image `maven:3.3.9` and a full git clone (`clone.depth: full`). 2. The SonarQube scan pipe `sonarsource/sonarqube-scan:2.0.1`. 3. A Sonar server at `${SONAR_HOST_URL}`, authenticated with `${SONAR_TOKEN}`, for project key `overdrive_go_api_AYqpslFAuNwRc2P2S9SL`. There is no database, identity provider, mail sender, queue, HTTP API, or Go runtime in this repository. Whether Bitbucket has `SONAR_HOST_URL` and `SONAR_TOKEN` configured is **Unknown / Requires Confirmation**. The pipeline comment says both values come from a repository or workspace variable, and that the token should not be set in clear text in the file. They are not in the file. ## Major workflows ### WF-1 — Commit to the repository **Implemented** as ordinary git history. Three commits exist, all on `master`, all on 2023-09-18. No pull-request pipeline, default pipeline, or tag pipeline is defined. ### WF-2 — SonarQube analysis on `{master}` **Implemented** in YAML. This inspection did not run the pipeline. Trigger: a pipeline run for a branch matching the key `{master}`. The only branch is `master`. Bitbucket documents brace lists such as `{master,main}` as matching those branch names, so a one-item list is the template's way of naming `master`. A successful match on a real run was not observed. Provenance of the key: **Implemented**. Provenance of the match: **Inferred**. Steps: 1. Clone with `depth: full`. 2. Run the pipe `sonarsource/sonarqube-scan:2.0.1` with `SONAR_HOST_URL` and `SONAR_TOKEN`. 3. The pipe reads `sonar-project.properties` from the checkout. The only property set is `sonar.projectKey`. Inputs expected and not stored in git: the two variable values. Inputs expected by a useful analysis and missing from git: application source. The step name is "SonarQube analysis". The script does not run tests, a build, Maven, or `go`. Failure behaviour is not defined. There is no retry, quality-gate condition, notification, or deployment environment block. ## Functional requirements ### FR-001 — Keep a Bitbucket repository named go_api **Implemented.** Remote: `git@bitbucket.org:overdrive/go_api.git`. Default branch: `master`. Tip: `366442a`. Evidence: `git remote`, `origin/HEAD`, `git log`. ### FR-002 — Ignore common generated files **Implemented** as Bitbucket's unmodified example `.gitignore`. The header says the list should be customized for the project. Patterns cover `node_modules/`, `dist/`, `*.class`, `*.py[cod]`, `*.log`, `*.jar`, Maven `target/`, `.idea/`, `TEST*.xml`, `.DS_Store`, `Thumbs.db`, `*.app`, `*.exe`, `*.war`, and several video and TIFF extensions. This file is not evidence that the product uses Node, Java, Python, and Maven together. It also does not list Go module paths such as `go.sum` or a `vendor/` directory. Provenance of the patterns: **Implemented** template. Provenance of a chosen stack: **Unknown**. Evidence: `.gitignore`, commit `14e18c6`. ### FR-003 — Identify a Sonar project **Implemented.** `sonar-project.properties` contains one line: ```text sonar.projectKey=overdrive_go_api_AYqpslFAuNwRc2P2S9SL ``` No `sonar.sources`, `sonar.exclusions`, `sonar.host.url`, `sonar.projectName`, or quality-gate property is set. Evidence: `sonar-project.properties`, commit `5c622e7`. ### FR-004 — Analyse the branch pattern `{master}` with the SonarQube pipe **Implemented** as script text. **Not observed** as a successful run. Image: `maven:3.3.9`. Step name: `SonarQube analysis`. Pipe: `sonarsource/sonarqube-scan:2.0.1`. Variables: `SONAR_HOST_URL`, `SONAR_TOKEN`. Branch key: `{master}`. Clone depth: `full`. The image is Maven. The script never calls `mvn`. There is no `pom.xml`. The script never calls `go`. There is no `go.mod`. Evidence: `bitbucket-pipelines.yml`, commit `366442a`. ### FR-005 — Keep the Sonar token out of the pipeline file **Documented** in a comment. **Implemented** as the absence of a literal token. The comment on `SONAR_TOKEN` says the value comes from a repository or workspace variable and should not be set in clear text. The file uses `${SONAR_TOKEN}`. No token string is committed. Evidence: `bitbucket-pipelines.yml`. ### FR-006 — A local Windows Sonar scan script **Not in git.** The task-creation scan named `sonarqube_scan.bat`. That path does not exist in `14e18c6`, `5c622e7`, or `366442a`. The pipeline does not call a `.bat` file. Provenance: **Unknown / Requires Confirmation.** ### FR-007 — A Go API **Not in git.** The repository name is the only evidence that a Go API was intended. No `go.mod`, `go.sum`, `.go` file, route table, or OpenAPI document exists. Provenance of a Go API product: **Unknown / Requires Confirmation.** ## Validation and errors No application validation exists. No error contract, status code, or user-facing message is defined. Pipeline failure modes visible from the file, without a successful run to observe: - `SONAR_HOST_URL` or `SONAR_TOKEN` unset. The comments say to take them from repository or workspace variables. Bitbucket's behaviour for an unset variable in this pipe is **Unknown** from this tree. - The scanner has three text files and no application sources. What Sonar reports for that tree is **Unknown / Requires Confirmation**. - The step does not declare a quality-gate failure condition. A failed analysis may or may not fail the pipeline. That is **Unknown** from this file. - The declared image is `maven:3.3.9` (a 2015 Maven image). Whether that image still resolves, and whether the pipe needs it, was not tested. ## Constraints - Sonar pipe pin: `sonarsource/sonarqube-scan:2.0.1`. - Image pin: `maven:3.3.9`. The script does not use Maven. - Clone depth is `full`, which keeps history available to the scanner. The file does not say why. Purpose: **Inferred** from the Sonar pipe's usual need for blame data. The setting itself is **Implemented**. - Credentials are pipeline variables, not files in git. That is the only secret-handling pattern present. - No application data model, retention rule, or privacy constraint is written down. ## Requirements that are assumptions Treating this repository as a Go API because the slug is `go_api` would be an assumption. There is no Go source. Treating the Maven image as a Java build would also be an assumption. The script does not run Maven, and there is no `pom.xml`. Treating `.gitignore` as a chosen polyglot stack would be an assumption. It is Bitbucket's stock example list. All three are **Unknown / Requires Confirmation**.