Skip to content

RC-349: Make lits plugin version configurable in ruling tests - #6191

Draft
romainbrenguier wants to merge 6 commits into
masterfrom
romain/romain/rc-349
Draft

romainbrenguier wants to merge 6 commits into
masterfrom
romain/romain/rc-349

Conversation

@romainbrenguier

Copy link
Copy Markdown
Contributor

Summary

  • Replace hardcoded sonar-lits-plugin version (0.11.0.2659) with a configurable system property sonar.lits.version, defaulting to LATEST_RELEASE
  • This allows CI to override the lits plugin version, enabling testing with a specific sonar-lits PR build (e.g., sonar-lits#172)

Test plan

  • Verify ruling tests still pass with default LATEST_RELEASE version
  • Verify ruling tests can be run with a specific version via -Dsonar.lits.version=X.Y.Z.N

🤖 Generated with Claude Code

Replace hardcoded sonar-lits-plugin version with a system property
(sonar.lits.version) defaulting to LATEST_RELEASE, allowing CI to
override it with a specific version from a sonar-lits PR build.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@hashicorp-vault-sonar-prod

hashicorp-vault-sonar-prod Bot commented Sep 17, 2026

Copy link
Copy Markdown
Contributor

RC-349

Comment on lines +104 to +105
.addPlugin(MavenLocation.of("org.sonarsource.sonar-lits-plugin", "sonar-lits-plugin",
System.getProperty("sonar.lits.version", "LATEST_RELEASE")));

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Bug: Default lits version now floats, silently bumping 0.11.0.2659

The PR is described as making the lits version configurable, but it also changes the default from the pinned 0.11.0.2659 to the LATEST_RELEASE alias. Maven Central metadata for org.sonarsource.sonar-lits-plugin already lists a newer release (0.12.0.5861), so every ruling run without -Dsonar.lits.version now silently uses a different plugin than before and will keep floating onto future releases — ruling QA (4 matrix jobs across Linux/Windows) becomes non-reproducible and can break on an unrelated lits release, with no repo change to point at. Keep the previously pinned version as the default so the property only overrides it when CI explicitly asks for a PR build.

Keep the pinned version as the default value of the new property:

.addPlugin(MavenLocation.of("org.sonarsource.sonar-lits-plugin", "sonar-lits-plugin",
  System.getProperty("sonar.lits.version", "0.11.0.2659")));
  • Apply fix

Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎

Comment thread .github/workflows/build.yml Outdated
extra_args+=(-Dparallel=methods -DuseUnlimitedThreads=true)
fi
mvn package ${MAVEN_OUTPUT_ARGS} "-Pit-ruling,${{ matrix.item.profile }}" -Dsonar.runtimeVersion=${{ matrix.item.sq_version }} -Dmaven.test.redirectTestOutputToFile=false "${extra_args[@]}"
mvn package ${MAVEN_OUTPUT_ARGS} "-Pit-ruling,${{ matrix.item.profile }}" -Dsonar.runtimeVersion=${{ matrix.item.sq_version }} -Dsonar.lits.version=0.13.0.6081 -Dmaven.test.redirectTestOutputToFile=false "${extra_args[@]}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Bug: CI pinned to unreleased lits build 0.13.0.6081

This commit hardcodes -Dsonar.lits.version=0.13.0.6081 into the shared ruling-qa job, and the commit itself is titled "[DO NOT MERGE]". Version 0.13.0.6081 of org.sonarsource.sonar-lits-plugin:sonar-lits-plugin is not a public release (latest published is 0.11.0.2659); it is a build produced for sonar-lits#172, so once that build ages out of the internal repository the resolution in JavaRulingTest.createOrchestrator() fails and every ruling-qa matrix entry (Linux and Windows) breaks on master. It also contradicts the PR's stated goal of running ruling against the default LATEST_RELEASE. Revert this line before merging, or keep the pin only on the throwaway validation branch.

Drop the temporary hardcoded lits version so CI uses the configurable default before merging.:

mvn package ${MAVEN_OUTPUT_ARGS} "-Pit-ruling,${{ matrix.item.profile }}" -Dsonar.runtimeVersion=${{ matrix.item.sq_version }} -Dmaven.test.redirectTestOutputToFile=false "${extra_args[@]}"
  • Apply fix

Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎

@github-actions

Copy link
Copy Markdown
Contributor

Ruling Diff Summary

Detected changes in 1 rule files: 9 issues removed, 0 issues added.

S9398 (java) on sonar-server - 9 issues removed, 0 issues added - deleted ruling file

Removed src/main/java/org/sonar/server/authentication/event/AuthenticationEvent.java (line 97)

(source file not found at this revision: src/main/java/org/sonar/server/authentication/event/AuthenticationEvent.java)

Removed src/main/java/org/sonar/server/computation/task/projectanalysis/filemove/FileSimilarity.java (line 28)

(source file not found at this revision: src/main/java/org/sonar/server/computation/task/projectanalysis/filemove/FileSimilarity.java)

Removed src/main/java/org/sonar/server/computation/task/projectanalysis/filemove/MovedFilesRepository.java (line 37)

(source file not found at this revision: src/main/java/org/sonar/server/computation/task/projectanalysis/filemove/MovedFilesRepository.java)

Removed src/main/java/org/sonar/server/es/IndexDefinition.java (line 31)

(source file not found at this revision: src/main/java/org/sonar/server/es/IndexDefinition.java)

Removed src/main/java/org/sonar/server/organization/BillingValidations.java (line 47)

(source file not found at this revision: src/main/java/org/sonar/server/organization/BillingValidations.java)

Removed src/main/java/org/sonar/server/organization/BillingValidations.java (line 65)

(source file not found at this revision: src/main/java/org/sonar/server/organization/BillingValidations.java)

Removed src/main/java/org/sonar/server/organization/OrganizationCreation.java (line 120)

(source file not found at this revision: src/main/java/org/sonar/server/organization/OrganizationCreation.java)

Removed src/main/java/org/sonar/server/organization/OrganizationCreation.java (line 126)

(source file not found at this revision: src/main/java/org/sonar/server/organization/OrganizationCreation.java)

Removed src/main/java/org/sonar/server/permission/ws/template/DefaultTemplatesResolver.java (line 43)

(source file not found at this revision: src/main/java/org/sonar/server/permission/ws/template/DefaultTemplatesResolver.java)

@datadog-sonarsource

datadog-sonarsource Bot commented Sep 17, 2026

Copy link
Copy Markdown

Pipelines

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 4 Pipeline jobs failed

Build | Ruling QA (warp-custom-ubuntu-24-04, without-sonarqube-project, LATEST_RELEASE) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Build | Ruling QA (warp-custom-windows-2022-l, without-sonarqube-project, LATEST_RELEASE) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Ruling Diff Comment | ruling-diff-comment — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

View all 4 failed jobs.

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 7b51521 | Docs | View more details | Give us feedback!

@github-actions

Copy link
Copy Markdown
Contributor

Ruling needs updating. A fix PR has been created: #6194

Please review and merge it into your branch.

final var prBranch = "eclipse-jetty-same-issues-as-main";

MavenBuild prBuild = test_existing_project("org.eclipse.jetty:jetty-project", prSourceCode)
MavenBuild prBuild = test_existing_project("https://github.com/SonarSource/ruling_java/tree/85d8a90d7dfa711f91388a0c869f89eb434b04d3", prSourceCode)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Bug: Jetty PR analysis given a GitHub URL as sonar.projectKey

test_existing_project(...) passes its first argument straight to sonar.projectKey (line 450), so the PR build now analyses project key https://github.com/SonarSource/ruling_java/tree/85d8a90... instead of the provisioned org.eclipse.jetty:jetty-project. That key contains / (not a legal SonarQube project key character) and was never provisioned or associated with the rules profile, so the PR-branch analysis fails or lands on an unrelated project — the sonar.pullrequest.base incremental cache from the main-branch run (line 247) no longer applies, and the timing assertions on time2 plus the LITS diff for eclipse-jetty-similar-to-main become meaningless. If the intent was to pin the ruling sources (commit message "Pin Jetty ruling project"), that belongs in the its/sources submodule pointer, which is still at 706cf13 and unchanged by this commit.

Restore the provisioned project key; pin the ruling sources via the its/sources submodule commit instead.:

MavenBuild prBuild = test_existing_project("org.eclipse.jetty:jetty-project", prSourceCode)
  • Apply fix

Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎

romainbrenguier and others added 2 commits September 17, 2026 16:59
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@gitar-bot

gitar-bot Bot commented Sep 17, 2026

Copy link
Copy Markdown
CI failed: Java ruling tests failed due to an invalid SonarQube project key validation error and missing actual ruling output directories for diff comparison.

Overview

Two related failure patterns were found across 9 logs analyzed: a SonarQube project key validation failure caused by an invalid URL in the ruling test configuration, and a subsequent artifact diff failure due to missing actual output directories when ruling tests failed.

Failures

SonarQube Project Validation Failure (confidence: high)

  • Type: test
  • Affected jobs: 105264817461
  • Related to change: yes
  • Root cause: The SonarQube scanner failed with a validation exception because the project key was set to a git tree URL containing slashes and special characters, violating project key rules.
  • Suggested fix: Update the ruling test configuration where the project key for the Jetty ruling project is defined to ensure it uses only allowed characters.

Missing Actual Ruling Directory Diff Failure (confidence: high)

  • Type: test
  • Affected jobs: 105269896398
  • Related to change: yes
  • Root cause: The actual ruling output directory (target/actual) was not generated properly because the ruling tests failed, causing the diff and diff2html-cli steps to fail with missing file errors.
  • Suggested fix: Ensure ruling tests complete successfully and generate the required output before attempting comparison steps.

Summary

  • Change-related failures: 2 test failures involving SonarQube project key validation and missing ruling output directories.
  • Infrastructure/flaky failures: 0 infrastructure or flaky failures.
  • Recommended action: Fix the project key configuration in the ruling tests so that the tests pass and correctly generate the ruling outputs.
Code Review ⚠️ Changes requested 0 closed / 3 findings

Adds configurability for the lits plugin version in ruling tests via a sonar.lits.version system property, but three blockers must be addressed before merge: the default changed from pinned 0.11.0.2659 to LATEST_RELEASE, making ruling non-reproducible and vulnerable to unrelated lits releases; the CI workflow is hardcoded to an unreleased build 0.13.0.6081 that will break once the internal repository ages it out; and the Jetty project reference was changed to a GitHub URL, which is not a valid SonarQube project key and breaks the incremental analysis setup.

⚠️ Bug: Default lits version now floats, silently bumping 0.11.0.2659

📄 its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:104-105 🔗 lits releases

The PR is described as making the lits version configurable, but it also changes the default from the pinned 0.11.0.2659 to the LATEST_RELEASE alias. Maven Central metadata for org.sonarsource.sonar-lits-plugin already lists a newer release (0.12.0.5861), so every ruling run without -Dsonar.lits.version now silently uses a different plugin than before and will keep floating onto future releases — ruling QA (4 matrix jobs across Linux/Windows) becomes non-reproducible and can break on an unrelated lits release, with no repo change to point at. Keep the previously pinned version as the default so the property only overrides it when CI explicitly asks for a PR build.

Keep the pinned version as the default value of the new property
.addPlugin(MavenLocation.of("org.sonarsource.sonar-lits-plugin", "sonar-lits-plugin",
  System.getProperty("sonar.lits.version", "0.11.0.2659")));
⚠️ Bug: CI pinned to unreleased lits build 0.13.0.6081

📄 .github/workflows/build.yml:124 📄 its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:104-105

This commit hardcodes -Dsonar.lits.version=0.13.0.6081 into the shared ruling-qa job, and the commit itself is titled "[DO NOT MERGE]". Version 0.13.0.6081 of org.sonarsource.sonar-lits-plugin:sonar-lits-plugin is not a public release (latest published is 0.11.0.2659); it is a build produced for sonar-lits#172, so once that build ages out of the internal repository the resolution in JavaRulingTest.createOrchestrator() fails and every ruling-qa matrix entry (Linux and Windows) breaks on master. It also contradicts the PR's stated goal of running ruling against the default LATEST_RELEASE. Revert this line before merging, or keep the pin only on the throwaway validation branch.

Drop the temporary hardcoded lits version so CI uses the configurable default before merging.
mvn package ${MAVEN_OUTPUT_ARGS} "-Pit-ruling,${{ matrix.item.profile }}" -Dsonar.runtimeVersion=${{ matrix.item.sq_version }} -Dmaven.test.redirectTestOutputToFile=false "${extra_args[@]}"
⚠️ Bug: Jetty PR analysis given a GitHub URL as sonar.projectKey

📄 its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:276 📄 its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:308 📄 its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:247

test_existing_project(...) passes its first argument straight to sonar.projectKey (line 450), so the PR build now analyses project key https://github.com/SonarSource/ruling_java/tree/85d8a90... instead of the provisioned org.eclipse.jetty:jetty-project. That key contains / (not a legal SonarQube project key character) and was never provisioned or associated with the rules profile, so the PR-branch analysis fails or lands on an unrelated project — the sonar.pullrequest.base incremental cache from the main-branch run (line 247) no longer applies, and the timing assertions on time2 plus the LITS diff for eclipse-jetty-similar-to-main become meaningless. If the intent was to pin the ruling sources (commit message "Pin Jetty ruling project"), that belongs in the its/sources submodule pointer, which is still at 706cf13 and unchanged by this commit.

Restore the provisioned project key; pin the ruling sources via the its/sources submodule commit instead.
MavenBuild prBuild = test_existing_project("org.eclipse.jetty:jetty-project", prSourceCode)
🤖 Prompt for agents
Code Review: Adds configurability for the lits plugin version in ruling tests via a `sonar.lits.version` system property, but three blockers must be addressed before merge: the default changed from pinned `0.11.0.2659` to `LATEST_RELEASE`, making ruling non-reproducible and vulnerable to unrelated lits releases; the CI workflow is hardcoded to an unreleased build `0.13.0.6081` that will break once the internal repository ages it out; and the Jetty project reference was changed to a GitHub URL, which is not a valid SonarQube project key and breaks the incremental analysis setup.

1. ⚠️ Bug: Default lits version now floats, silently bumping 0.11.0.2659
   Files: its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:104-105

   The PR is described as making the lits version configurable, but it also changes the default from the pinned `0.11.0.2659` to the `LATEST_RELEASE` alias. Maven Central metadata for `org.sonarsource.sonar-lits-plugin` already lists a newer release (0.12.0.5861), so every ruling run without `-Dsonar.lits.version` now silently uses a different plugin than before and will keep floating onto future releases — ruling QA (4 matrix jobs across Linux/Windows) becomes non-reproducible and can break on an unrelated lits release, with no repo change to point at. Keep the previously pinned version as the default so the property only overrides it when CI explicitly asks for a PR build.

   Fix (Keep the pinned version as the default value of the new property):
   .addPlugin(MavenLocation.of("org.sonarsource.sonar-lits-plugin", "sonar-lits-plugin",
     System.getProperty("sonar.lits.version", "0.11.0.2659")));

2. ⚠️ Bug: CI pinned to unreleased lits build 0.13.0.6081
   Files: .github/workflows/build.yml:124, its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:104-105

   This commit hardcodes `-Dsonar.lits.version=0.13.0.6081` into the shared `ruling-qa` job, and the commit itself is titled "[DO NOT MERGE]". Version 0.13.0.6081 of `org.sonarsource.sonar-lits-plugin:sonar-lits-plugin` is not a public release (latest published is 0.11.0.2659); it is a build produced for sonar-lits#172, so once that build ages out of the internal repository the resolution in `JavaRulingTest.createOrchestrator()` fails and every ruling-qa matrix entry (Linux and Windows) breaks on master. It also contradicts the PR's stated goal of running ruling against the default `LATEST_RELEASE`. Revert this line before merging, or keep the pin only on the throwaway validation branch.

   Fix (Drop the temporary hardcoded lits version so CI uses the configurable default before merging.):
   mvn package ${MAVEN_OUTPUT_ARGS} "-Pit-ruling,${{ matrix.item.profile }}" -Dsonar.runtimeVersion=${{ matrix.item.sq_version }} -Dmaven.test.redirectTestOutputToFile=false "${extra_args[@]}"

3. ⚠️ Bug: Jetty PR analysis given a GitHub URL as sonar.projectKey
   Files: its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:276, its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:308, its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:247

   `test_existing_project(...)` passes its first argument straight to `sonar.projectKey` (line 450), so the PR build now analyses project key `https://github.com/SonarSource/ruling_java/tree/85d8a90...` instead of the provisioned `org.eclipse.jetty:jetty-project`. That key contains `/` (not a legal SonarQube project key character) and was never provisioned or associated with the `rules` profile, so the PR-branch analysis fails or lands on an unrelated project — the `sonar.pullrequest.base` incremental cache from the main-branch run (line 247) no longer applies, and the timing assertions on `time2` plus the LITS diff for `eclipse-jetty-similar-to-main` become meaningless. If the intent was to pin the ruling sources (commit message "Pin Jetty ruling project"), that belongs in the `its/sources` submodule pointer, which is still at `706cf13` and unchanged by this commit.

   Fix (Restore the provisioned project key; pin the ruling sources via the its/sources submodule commit instead.):
   MavenBuild prBuild = test_existing_project("org.eclipse.jetty:jetty-project", prSourceCode)

Review coverage

Functional validation 0 of 1 objectives covered

Rules No rules evaluated

Auto-approval Not enabled · Set up

Implementation Status ◻️ 0 of 1 objectives covered
◻️ RC-349 - 0 of 1 objectives covered

This PR updates the LITS plugin version and configures its usage in ruling tests, but does not standardize the JSON expectation format as requested by the issue.

Other objectives on this issue, possibly covered elsewhere:

  • ◻️ Standardize JSON format for expectation files

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.
Unblock → Override a blocking verdict and allow merging.

Comment with these commands to change the behavior for this request:

Auto-apply Compact Unblock
gitar auto-apply:on         
gitar display:verbose         
gitar unblock         

Was this helpful? React with 👍 / 👎 | Gitar

@sonarqube-next

Copy link
Copy Markdown
Contributor

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant