ci(sonar,netlify): use SonarCloud Automatic Analysis and disable Netlify PR previews

.codacy.yml

@@ -4,6 +4,10 @@ engines:
     exclude_paths:
       # CSSLint does not support CSS custom properties used by Docusaurus/Infima
       - 'website/src/css/custom.css'
+  eslint-8:
+    exclude_paths: []
+  opengrep:
+    exclude_paths: []
   remark-lint:
     exclude_paths:
       # Generated release notes contain markdown constructs (e.g. `[bot]`)

.sonarcloud.properties

@@ -0,0 +1,29 @@
+# SonarQube Cloud Automatic Analysis configuration
+# https://docs.sonarsource.com/sonarqube-cloud/analyzing-source-code/automatic-analysis
+sonar.sources=.
+sonar.sourceEncoding=UTF-8
+
+# Scope the whole-repo scan to first-party code.
+# (Issue ignores such as S5332/S4721/S4036/S7637 must be configured in the
+# SonarCloud UI; sonar.issue.ignore.* is not honored by Automatic Analysis.)
+sonar.exclusions=\
+  bun.lock,\
+  CHANGELOG.md,\
+  **/node_modules/**,\
+  **/dist/**,\
+  **/coverage/**,\
+  **/tmp/**,\
+  **/.git/**,\
+  **/.nx/**,\
+  **/generated/**,\
+  .agents/**,\
+  .cursor/**,\
+  .windsurf/**,\
+  .claude/**
+
+sonar.cpd.exclusions=\
+  **/generated/**,\
+  **/*.test.ts,\
+  **/*.spec.ts,\
+  **/tests/**,\
+  **/fixtures/**

netlify.toml

@@ -30,3 +30,12 @@
 [build.environment]
   NODE_VERSION = "20"
   NX_DAEMON = "false"
+
+# Only run production deploys from the main branch.
+# Deploy previews for pull requests and branch deploys are disabled to save
+# Netlify build minutes; the ignore script above still applies to production.
+[context.deploy-preview]
+  ignore = "exit 0"
+
+[context.branch-deploy]
+  ignore = "exit 0"