SONARJAVA-6205 Add an agentic focused quality profile for Java by dorian-burihabwa-sonarsource · Pull Request #5531 · SonarSource/sonar-java

dorian-burihabwa-sonarsource · 2026-03-20T12:45:26Z

No description provided.

hashicorp-vault-sonar-prod · 2026-03-20T12:45:40Z

sonar-review-alpha · 2026-03-20T15:56:50Z

Summary

This PR refactors quality profile handling and adds a new "Sonar agentic AI" profile focused on AI-assisted development.

Key Changes:

New base class BuiltInJavaQualityProfile: Consolidates common profile logic (JSON loading, ProfileRegistrar integration, security rule reflection) that was previously duplicated in JavaSonarWayProfile
Removed DBD reflection: The dataflow-bug-detection rules are now loaded automatically via ProfileRegistrar instead of reflection, simplifying the code
Refactored JavaSonarWayProfile: Now extends the base class, reducing ~40 lines of duplicate code while maintaining identical behavior
Added JavaAgenticWayProfile: A new quality profile with 467 rules curated for AI-assisted development, registered alongside the existing Sonar Way profile
Updated tests: Changed method invocations from static to instance methods, removed DBD-specific test, added comprehensive test for the new agentic profile including a CSV utility method

What reviewers should know

Where to start:

Review BuiltInJavaQualityProfile.java first — this is the new abstraction layer
Check how JavaSonarWayProfile.java is simplified by extending it
Review JavaAgenticWayProfile.java to understand the new profile implementation
Check Sonar_agentic_ai_profile.json to see the 467 selected rules

Non-obvious decisions:

Security rules still use reflection (line 78-84) with a FIXME pointing to SONARJAVA-6207 for future removal — this is a known limitation
The disabled test utility (generate_ai_quality_profile) shows how the agentic rule set was generated from CSV; reviewers may want to understand the curation criteria
ProfileRegistrars now handle DBD rules automatically, so that reflection code was intentionally removed

Things to verify:

The 467 rules in the agentic profile are appropriate for AI/agent-assisted development (check if the selection aligns with coding quality vs. style)
Ensure backward compatibility: Sonar Way remains the default profile and hasn't changed functionally
Test counts in JavaPluginTest were updated from 36→37 and 37→38; verify this matches the added extensions
The commons-csv dependency is only in tests (appropriate for the CSV generation utility)

Generate Walkthrough
Generate Diagram

🗣️ Give feedback

rombirli

LGTM! I just have two questions about external rules inclusion mechanism and the purpose of profileRegistrars

rombirli · 2026-03-23T07:05:44Z

sonar-java-plugin/src/main/java/org/sonar/plugins/java/QualityProfileUtils.java

+      for (ProfileRegistrar profileRegistrar : profileRegistrars) {
+        profileRegistrar.register(ruleKeys::addAll);
+      }


In test JavaAgenticWayProfileTest, profileRegistrars is always null and this part is never covered, is there a reason ?

rombirli · 2026-03-23T07:10:33Z

sonar-java-plugin/src/main/java/org/sonar/plugins/java/JavaAgenticWayProfile.java

+  public void define(Context context) {
+    NewBuiltInQualityProfile agenticWay = context.createBuiltInQualityProfile("AI Quality Profile", Java.KEY);
+    Set<RuleKey> ruleKeys = QualityProfileUtils.registerRulesFromJson(
+      "/org/sonar/l10n/java/rules/java/Agentic_way_profile.json",


This string constant could be extracted in a constant SONAR_AGENTIC_WAY_PATH like SONAR_WAY_PATH in JavaSonarWayProfile

rombirli · 2026-03-23T07:24:09Z

sonar-java-plugin/src/main/java/org/sonar/plugins/java/JavaAgenticWayProfile.java

+    ruleKeys.forEach(ruleKey -> agenticWay.activateRule(ruleKey.repository(), ruleKey.rule()));
+    agenticWay.done();
+  }


These lines and the creation of agenticWay (or sonarWay) are repeated in JavaSonarWayProfile, maybe it could be refactored in QualityProfileUtils

static void createQualityProfile(String title, Set<RuleKey> ruleKeys) { NewBuiltInQualityProfile way = context.createBuiltInQualityProfile(title, Java.KEY); ruleKeys.forEach(ruleKey -> way.activateRule(ruleKey.repository(), ruleKey.rule())); way.done(); } }

rombirli · 2026-03-23T07:28:31Z

sonar-java-plugin/src/main/java/org/sonar/plugins/java/JavaSonarWayProfile.java

Is there a reason this mechanism to include external rules is not present in JavaAgenticWayProfile? (Why the implementations diverge? Is there a justification?)

rombirli

Agentic_way_profile.json seems to be wrong

rombirli · 2026-03-23T07:37:00Z

...-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/Sonar_agentic_ai_profile.json

Is this file auto-generated from the CSV with a script? Could we add the script to the repo? It seems to be wrong!
S100 shouldn't be included according to the spreadsheet.

rombirli

LGTM i get the exact same json quality profile file, I still have 2 refactoring proposals :

use tsv format instead of csv to get rid of csv library (so we can simply split with '\t' instead of ';')
use a single class that take qp name and json path instead of duplicated logic (we could also get rid of qualityprofileutils.java and put everything in this class)

sonar-review-alpha

Conclusion: Clean refactoring overall — the base class extraction is well-done and the agentic profile is properly wired up. Two issues in the generator utility method worth fixing before someone uses it to regenerate the profile.

🗣️ Give feedback

sonar-review-alpha · 2026-03-26T11:29:08Z

sonar-java-plugin/src/test/java/org/sonar/plugins/java/JavaAgenticWayProfileTest.java

+        return fileName.substring(0, fileName.lastIndexOf('.'));
+      })
+      .collect(Collectors.toSet());
+  }


Path.endsWith(String) does not work like String.endsWith(String). On a Path, it checks whether the path ends with a complete path segment named exactly "_profile.json", not whether the filename string ends with that suffix. This predicate is always false, so profile JSON files (Sonar_way_profile.json, Agentic_way_profile.json, etc.) are never excluded from keysOfImplementedRules.

The bug is harmless today because profile filenames won't appear as rule IDs in the CSV, but the filter silently does nothing. Fix:

.filter(path -> !path.getFileName().toString().endsWith("_profile.json"))

Mark as noise

sonar-review-alpha · 2026-03-26T11:29:08Z

sonar-java-plugin/src/test/java/org/sonar/plugins/java/JavaAgenticWayProfileTest.java

+      Path.of("Path", "to", "your", "input.csv"),
+      RULE_DESCRIPTION_DIRECTORY.resolve("Agentic_way_profile.json"),
+      "AI Quality Profile"
+    );


generate_ai_quality_profile() is missing @Test. In JUnit 5, @Disabled without @Test is a no-op — the framework never discovers the method, so the annotation provides no documentation value and could mislead a future developer into thinking this was intentionally skipped rather than just a utility method. Either add @Test so @Disabled works as intended, or remove @Disabled and leave it as a plain utility method with a descriptive Javadoc comment.

Mark as noise

Refactored to re-use the same code to initialize quality profiles assuming that all DBD and security rules should be part of the new quality profile.

DBD registers rules using ProfileRegistrar defined in the sonar-java API and is therefore automatically loaded into all built-in quality profiles.

sonarqube-next · 2026-03-30T12:45:46Z

Quality Gate passed

Issues
0 New issues
1 Fixed issue
1 Accepted issue

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

sonar-review-alpha

LGTM! ✅

Solid refactoring with no new bugs. The two previously flagged issues (the Path.endsWith no-op filter and @Disabled without @Test) are the only items to address before merge.

🗣️ Give feedback

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch 2 times, most recently from 37eb8d7 to 0dab089 Compare March 20, 2026 15:29

dorian-burihabwa-sonarsource marked this pull request as ready for review March 20, 2026 15:56

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch from 0dab089 to 31312fc Compare March 20, 2026 16:24

This comment was marked as resolved.

Sign in to view

rombirli self-requested a review March 23, 2026 06:52

rombirli approved these changes Mar 23, 2026

View reviewed changes

rombirli requested changes Mar 23, 2026

View reviewed changes

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch from e818473 to 35e7ca4 Compare March 23, 2026 17:02

rombirli approved these changes Mar 24, 2026

View reviewed changes

sonar-review-alpha bot reviewed Mar 26, 2026

View reviewed changes

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch from 06e2ee5 to b890cc6 Compare March 26, 2026 15:02

This comment was marked as resolved.

Sign in to view

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch from b890cc6 to 7ed374a Compare March 26, 2026 16:31

This comment was marked as outdated.

Sign in to view

dorian-burihabwa-sonarsource added 5 commits March 30, 2026 11:39

SONARJAVA-6205 Add an agentic focused quality profile for Java

9b8a4ed

SONARJAVA-6205 Add test script to generate profile from CSV file

bb359f7

SONARJAVA-6205 Remove S100 from AI quality profile

cc58346

SONARJAVA-6205 Include DBD and security rules as part of Agentic profile

e212191

Refactored to re-use the same code to initialize quality profiles assuming that all DBD and security rules should be part of the new quality profile.

SONARJAVA-6205 Rename profile to 'Sonar Agentic AI'

2530f82

This comment was marked as outdated.

Sign in to view

SONARJAVA-6205 Restrict visibility of utility test methods

bc0490c

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch from 11be7ab to bc0490c Compare March 30, 2026 11:14

This comment was marked as outdated.

Sign in to view

SONARJAVA-6205 Remove reflection to load DBD rule keys

d9b1b7b

DBD registers rules using ProfileRegistrar defined in the sonar-java API and is therefore automatically loaded into all built-in quality profiles.

sonar-review-alpha bot reviewed Mar 30, 2026

View reviewed changes

Conversation

dorian-burihabwa-sonarsource commented Mar 20, 2026

Uh oh!

hashicorp-vault-sonar-prod bot commented Mar 20, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonar-review-alpha bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What reviewers should know

Uh oh!

This comment was marked as resolved.

Uh oh!

rombirli left a comment

Choose a reason for hiding this comment

Uh oh!

rombirli Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli left a comment

Choose a reason for hiding this comment

Uh oh!

rombirli Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli left a comment

Choose a reason for hiding this comment

Uh oh!

sonar-review-alpha bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonar-review-alpha bot Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

sonar-review-alpha bot Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

sonarqube-next bot commented Mar 30, 2026

Quality Gate passed

Uh oh!

sonar-review-alpha bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hashicorp-vault-sonar-prod bot commented Mar 20, 2026 •

edited by atlassian bot

Loading

sonar-review-alpha bot commented Mar 20, 2026 •

edited

Loading