# PRD — simpleform_frontend_reactjs Evidence date: 2026-10-03. Source: `git@bitbucket.org:overdrive/simpleform_frontend_reactjs.git`, `master` at `4915764` (2023-12-21). There is no prior PRD in the source repository or in Silicon Ark. The repository has no README and no application. Requirements below are recovered from `.gitignore`, `sonar-project.properties`, and `bitbucket-pipelines.yml`. Provenance is labelled. Pipeline secret values are not in git. ## Product purpose **Unknown.** Nothing in the repository states what simpleform_frontend_reactjs does, who uses it, or which problem it solves. **Implemented.** The repository holds a default ignore file, a SonarQube project key, and a Bitbucket Pipelines definition that runs `sonarsource/sonarqube-scan:2.0.1`. **Unknown / Requires Confirmation:** whether this repository is an unstarted React front end, a Sonar-only placeholder, or the scan hook for source that lives somewhere else. The slug is the only place the words "simpleform" and "reactjs" appear. ## Users and roles | Actor | Evidence | Status | |---|---|---| | Repository author | All three commits, Jaco Brits (`jaco@overdrive.co.za`) | **Implemented** as git history only | | Pipeline / Sonar operator | Variables `SONAR_HOST_URL` and `SONAR_TOKEN` | **Inferred** from the pipe variables. No user interface | | End user of a Simpleform product | No screen, API, or role in the tree | **Unknown** | No login, session, permission, or role check exists. ## Systems the product talks to The pipeline, if it ran, would talk to: 1. Bitbucket Pipelines, using image `maven:3.3.9` and a full git clone (`clone.depth: full`). 2. The SonarQube scan pipe `sonarsource/sonarqube-scan:2.0.1`. 3. A Sonar server at `${SONAR_HOST_URL}`, authenticated with `${SONAR_TOKEN}`, for project key `overdrive_simpleform_frontend_reactjs_AYyLZItsX_eKQO3WBKsI`. There is no database, identity provider, mail sender, queue, HTTP API, or React runtime in this repository. Whether Bitbucket has `SONAR_HOST_URL` and `SONAR_TOKEN` configured is **Unknown / Requires Confirmation**. The pipeline comment says both values come from a repository or workspace variable, and that the token should not be set in clear text in the file. They are not in the file. ## Major workflows ### WF-1 — Commit to the repository **Implemented** as ordinary git history. Three commits exist, all on `master`, all on 2023-12-21. No pull-request pipeline, default pipeline, or tag pipeline is defined. ### WF-2 — SonarQube analysis on `{master}` **Implemented** in YAML. This inspection did not run the pipeline. Trigger: a pipeline run for a branch matching the key `{master}`. The only branch is `master`. Bitbucket documents brace lists such as `{master,main}` as matching those branch names, so a one-item list is the template's way of naming `master`. A successful match on a real run was not observed. Provenance of the key: **Implemented**. Provenance of the match: **Inferred**. Steps: 1. Clone with `depth: full`. 2. Run the pipe `sonarsource/sonarqube-scan:2.0.1` with `SONAR_HOST_URL` and `SONAR_TOKEN`. 3. The pipe reads `sonar-project.properties` from the checkout. The only property set is `sonar.projectKey`. Inputs expected and not stored in git: the two variable values. Inputs expected by a useful analysis and missing from git: application source. The step name is "SonarQube analysis". The script does not run tests, a build, or Maven. Failure behaviour is not defined. There is no retry, quality-gate condition, notification, or deployment environment block. ## Functional requirements ### FR-001 — Keep a Bitbucket repository named simpleform_frontend_reactjs **Implemented.** Remote: `git@bitbucket.org:overdrive/simpleform_frontend_reactjs.git`. Default branch: `master`. Tip: `4915764`. Evidence: `git remote`, `origin/HEAD`, `git log`. ### FR-002 — Ignore common generated files **Implemented** as Bitbucket's unmodified example `.gitignore`. The header says the list should be customized for the project. Patterns cover `node_modules/`, `dist/`, `*.class`, `*.py[cod]`, `*.log`, `*.jar`, Maven `target/`, `.idea/`, `TEST*.xml`, `.DS_Store`, `Thumbs.db`, `*.app`, `*.exe`, `*.war`, and several video and TIFF extensions. This file is not evidence that the product uses Node, Java, Python, and Maven together. Provenance of the patterns: **Implemented** template. Provenance of a chosen stack: **Unknown**. Evidence: `.gitignore`, commit `b1f9070`. ### FR-003 — Identify a Sonar project **Implemented.** `sonar-project.properties` contains one line: ```text sonar.projectKey=overdrive_simpleform_frontend_reactjs_AYyLZItsX_eKQO3WBKsI ``` No `sonar.sources`, `sonar.exclusions`, `sonar.host.url`, `sonar.projectName`, or quality-gate property is set. Evidence: `sonar-project.properties`, commit `046cc2c`. ### FR-004 — Analyse the branch pattern `{master}` with the SonarQube pipe **Implemented** as script text. **Not observed** as a successful run. Image: `maven:3.3.9`. Step name: `SonarQube analysis`. Pipe: `sonarsource/sonarqube-scan:2.0.1`. Variables: `SONAR_HOST_URL`, `SONAR_TOKEN`. Branch key: `{master}`. Clone depth: `full`. The image is Maven. The script never calls `mvn`. There is no `pom.xml`. Evidence: `bitbucket-pipelines.yml`, commit `4915764`. ### FR-005 — Keep the Sonar token out of the pipeline file **Documented** in a comment. **Implemented** as the absence of a literal token. The comment on `SONAR_TOKEN` says the value comes from a repository or workspace variable and should not be set in clear text. The file uses `${SONAR_TOKEN}`. No token string is committed. Evidence: `bitbucket-pipelines.yml`. ### FR-006 — A local Windows Sonar scan script **Not in git.** The task-creation scan named `sonarqube_scan.bat`. That path does not exist in `b1f9070`, `046cc2c`, or `4915764`. The pipeline does not call a `.bat` file. Provenance: **Unknown / Requires Confirmation.** ### FR-007 — A React front end **Not in git.** The repository name is the only evidence that a React front end was intended. No `package.json`, `src/`, JSX, or HTML file exists. Provenance of a React product: **Unknown / Requires Confirmation.** ## Validation and errors No application validation exists. No error contract, status code, or user-facing message is defined. Pipeline failure modes visible from the file, without a successful run to observe: - `SONAR_HOST_URL` or `SONAR_TOKEN` unset. The comments say to take them from repository or workspace variables. Bitbucket's behaviour for an unset variable in this pipe is **Unknown** from this tree. - The scanner has three text files and no application sources. What Sonar reports for that tree is **Unknown / Requires Confirmation**. - The step does not declare a quality-gate failure condition. A failed analysis may or may not fail the pipeline. That is **Unknown** from this file. - The declared image is `maven:3.3.9` (a 2015 Maven image). Whether that image still resolves, and whether the pipe needs it, was not tested. ## Constraints - Sonar pipe pin: `sonarsource/sonarqube-scan:2.0.1`. - Image pin: `maven:3.3.9`. The script does not use Maven. - Clone depth is `full`, which keeps history available to the scanner. The file does not say why. Purpose: **Inferred** from the Sonar pipe's usual need for blame data. The setting itself is **Implemented**. - Credentials are pipeline variables, not files in git. That is the only secret-handling pattern present. - No application data model, retention rule, or privacy constraint is written down. ## Requirements that are assumptions Treating this repository as a React application because the slug contains `reactjs` would be an assumption. There is no React source. Treating the Maven image as a Java build would also be an assumption. The script does not run Maven, and there is no `pom.xml`. Treating `.gitignore` as a chosen polyglot stack would be an assumption. It is Bitbucket's stock example list. All three are **Unknown / Requires Confirmation**.