chore(sonar): add XOOPS-convention exclusions to the baseline template

.gitattributes

@@ -29,4 +29,3 @@
 /sonar-project.properties export-ignore
 /.git-blame-ignore-revs export-ignore
 /composer.lock          export-ignore
-/CHANGELOG.md           export-ignore

.gitignore

@@ -67,9 +67,9 @@ package-lock.json
 
 # --- Local overrides of committed *.dist configs ---
 /.php-cs-fixer.php
-phpstan.neon
-phpunit.xml
-psalm.xml
+/phpstan.neon
+/phpunit.xml
+/psalm.xml
 
 # --- Environment, logs & secrets ---
 .env

sonar-project.properties

@@ -12,11 +12,52 @@ sonar.projectName=module-devops
 
 # Analyse PHP sources; keep vendored code, tooling, generated dirs, and tests out of "sources".
 sonar.sources=.
-sonar.exclusions=vendor/**,.build/**,node_modules/**,language/**,templates/**,templates_c/**,assets/**,docs/**,rector.php,.php-cs-fixer.dist.php,phpstan-bootstrap.php,stubs/**
+sonar.exclusions=vendor/**,.build/**,node_modules/**,language/**,templates/**,templates_c/**,assets/**,docs/**,tests/**,rector.php,.php-cs-fixer.dist.php,phpstan-bootstrap.php,stubs/**
 sonar.tests=tests
 sonar.test.inclusions=tests/**/*Test.php
 
 # Coverage (optional): sonar.yml writes a clover report here when tests + a coverage driver exist.
 sonar.php.coverage.reportPaths=.build/coverage/clover.xml
 
 sonar.sourceEncoding=UTF-8
+
+# --- XOOPS-convention false positives: permanently ignored ---
+# SonarPHP's default naming/quality rules clash with mandated XOOPS conventions and with
+# the shape of test doubles. Ignored here (in-repo, versioned) rather than per-issue in the
+# UI, so the suppression is reviewable and survives every scan.
+#
+# NOTE: these properties are honoured ONLY by the CI scanner. SonarCloud's server-side
+# Automatic Analysis ignores this file entirely -- disable Automatic Analysis
+# (project -> Administration -> Analysis Method) so the CI scanner + this file take effect.
+sonar.issue.ignore.multicriteria=x1,x2a,x2b,x3,x4,x5
+
+# S115: constant names must match ^[A-Z]..., but every XOOPS _MI_/_MA_/_AM_ constant
+# begins with an underscore -- the rule can never pass for XOOPS language constants.
+# Scoped to language/, the mandated home of those constants; all other PHP keeps S115.
+sonar.issue.ignore.multicriteria.x1.ruleKey=php:S115
+sonar.issue.ignore.multicriteria.x1.resourceKey=language/**/*.php
+
+# S100: function names must be camelCase, but XOOPS mandates snake_case entry points:
+# lifecycle hooks in include/ (xoops_module_install_<dirname>, ...) and block callbacks
+# in blocks/ (b_<dirname>_<block>_show/edit). Class code elsewhere stays camelCase-checked.
+sonar.issue.ignore.multicriteria.x2a.ruleKey=php:S100
+sonar.issue.ignore.multicriteria.x2a.resourceKey=include/**/*.php
+sonar.issue.ignore.multicriteria.x2b.ruleKey=php:S100
+sonar.issue.ignore.multicriteria.x2b.resourceKey=blocks/**/*.php
+
+# S1172 + S1186: a test double must match the real signature it stands in for, so its
+# parameters are "unused" and its bodies are empty by design. Only tests/**/*Test.php is
+# indexed (tests/** is source-excluded above; sonar.test.inclusions selects *Test.php),
+# and doubles reach the analyzer as inline classes in those files -- path patterns cannot
+# separate them from the tests beside them, so the ignore stays on tests/**.
+sonar.issue.ignore.multicriteria.x3.ruleKey=php:S1172
+sonar.issue.ignore.multicriteria.x3.resourceKey=tests/**
+sonar.issue.ignore.multicriteria.x4.ruleKey=php:S1186
+sonar.issue.ignore.multicriteria.x4.resourceKey=tests/**
+
+# S1142: guard-clause early returns are the intentional house style across XOOPS module
+# entry points (install/update hooks, preload handlers, providers, permission checks),
+# not a per-file exception -- "too many return statements" is noise against that idiom,
+# so this ignore is deliberately repo-wide.
+sonar.issue.ignore.multicriteria.x5.ruleKey=php:S1142
+sonar.issue.ignore.multicriteria.x5.resourceKey=**/*.php