From 6e27fbc415e4c5da64819b5ec3bafcbe21a5f054 Mon Sep 17 00:00:00 2001
From: Pixnop <77785313+Pixnop@users.noreply.github.com>
Date: Wed, 2 Sep 2026 18:18:12 +0200
Subject: [PATCH] Keep the quality gate green after the dashboard wave

---
 .github/workflows/sonar.yml        |  2 +-
 contrib/grafana/check-dashboard.py | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index 9bfdd9c..eeb6347 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -93,7 +93,7 @@ jobs:
             /d:sonar.token="$SONAR_TOKEN" \
             /d:sonar.host.url="https://sonarcloud.io" \
             /d:sonar.exclusions="**/bin/**,**/obj/**,docs/**" \
-            /d:sonar.coverage.exclusions="Pulse/PulseModSystem.cs,Pulse.Otlp/PulseOtlpModSystem.cs,Pulse/EngineProbe.cs" \
+            /d:sonar.coverage.exclusions="Pulse/PulseModSystem.cs,Pulse.Otlp/PulseOtlpModSystem.cs,Pulse/EngineProbe.cs,contrib/**,tools/**" \
             /d:sonar.cs.opencover.reportsPaths="**/TestResults/**/coverage.opencover.xml"
 
       - name: Build
diff --git a/contrib/grafana/check-dashboard.py b/contrib/grafana/check-dashboard.py
index e2db862..a21ef58 100644
--- a/contrib/grafana/check-dashboard.py
+++ b/contrib/grafana/check-dashboard.py
@@ -12,10 +12,23 @@
 """
 
 import json
+import pathlib
 import sys
 
 COLUMNS = 24
 
+# The dashboards this script exists to check live in the repository, so that is
+# the only place it will read from: a stray argument cannot walk it out to an
+# arbitrary file.
+REPO = pathlib.Path(__file__).resolve().parent.parent.parent
+
+
+def inside_repo(path):
+    try:
+        return pathlib.Path(path).resolve().is_relative_to(REPO)
+    except OSError:
+        return False
+
 
 def panels(dashboard):
     """Every panel with a flag for whether it sits on the dashboard's own grid.
@@ -81,6 +94,10 @@ def main(paths):
 
     failed = False
     for path in paths:
+        if not inside_repo(path):
+            print(f"{path}: outside the repository, refusing to read it")
+            failed = True
+            continue
         try:
             problems = check(path)
         except (OSError, json.JSONDecodeError) as e: