# SonarDesk
Native macOS SonarQube dashboard built with SwiftUI.

## Open
Open `SonarDesk.xcodeproj` in Xcode, select your Development Team under Signing & Capabilities, then Run.

## First connection
Open SonarDesk > Settings, add your SonarQube Server URL and a SonarQube user token. Tokens are stored in Keychain.

## Included
- Multiple SonarQube servers
- Keychain token storage
- Server status/version
- Project dashboard
- Quality gate state
- Bugs, vulnerabilities, smells, coverage, duplication, LOC
- Project detail
- Unresolved issue browser/search
- Sandboxed outgoing networking

## v1.2 dashboard improvements
- Colour-accented interactive dashboard cards.
- Bugs and Vulnerabilities cards navigate directly to filtered global issues.
- Failed Gates card filters the dashboard project list to failing quality gates.
- Projects card restores the complete project list.
- Dashboard project rows are clickable and open project details.
- Dashboard project pagination with 10, 25, and 50 rows per page.
- Existing user-defined sidebar project ordering is preserved by pagination.

## v1.3
- Server-side pagination for All Issues, Bugs, Vulnerabilities and Code Smells (25/50/100 rows).
- Dedicated issue destinations in the main sidebar.
- Project metric navigation replaces the old View label/buttons; every metric card has a destination.
- Professional semantic colour system across dashboard/project metrics.
- New SonarDesk application icon and branded launch splash.

## v2.0.2 branding fix
- AppIcon is explicitly selected by the target and `CFBundleIconName`.
- SonarDeskLogo is bundled as a normal image asset and applied to `NSApplication.applicationIconImage` at launch, including development runs.
- Startup now begins on a dedicated branded launch view for at least 1.6 seconds while the initial SonarQube refresh runs, then transitions into the main UI.

## v2.1.0 — Direct distribution hardening
- Hardened Runtime explicitly enabled for Debug and Release.
- App Sandbox retained with only outbound network access.
- No hardened-runtime exception entitlements (no JIT, unsigned executable memory, DYLD injection, or disabled library validation).
- Release builds do not inject Xcode debug entitlements.
- SonarQube tokens remain in Keychain and are marked ThisDeviceOnly.
- Networking uses an ephemeral URLSession with no URL cache or cookie store.
- Production SonarQube endpoints must use HTTPS; plain HTTP is limited to localhost development.
- Server error response bodies are not surfaced to the UI.
- `Distribution/ExportOptions.plist` is included for Developer ID export.
- `Distribution/notarize.sh` verifies signing, submits with `notarytool`, staples the ticket, and runs Gatekeeper assessment.

### Direct release workflow
1. In Xcode, set your Apple Developer Team and ensure a **Developer ID Application** certificate is available.
2. Product > Archive.
3. Organizer > Distribute App > Developer ID / Direct Distribution and export the signed app.
4. Store notarization credentials once, for example:
   `xcrun notarytool store-credentials SonarDesk-Notary --apple-id YOUR_APPLE_ID --team-id YOUR_TEAM_ID --password YOUR_APP_SPECIFIC_PASSWORD`
5. Run: `NOTARY_PROFILE=SonarDesk-Notary ./Distribution/notarize.sh /path/to/SonarDesk.app`
6. Distribute the stapled app in a DMG/ZIP. Do not re-sign or modify the app after notarization.

Before every release, test the exported build on a clean macOS user account and run `codesign --verify --deep --strict`, `spctl --assess --type execute`, and `xcrun stapler validate`.