Test ruling-diff action across all ruling projects by romainbrenguier · Pull Request #6429 · SonarSource/sonar-java

romainbrenguier · 2026-10-29T10:20:42Z

Purpose

Draft test PR for the ruling-diff feature; not intended for merge.

Changes

Move one expected issue five lines up in one expectation file for each of the 11 ruling projects.
Pin the ruling-diff-comment action to commit 3273aad355fb3463f1405a58a88d2f8b2b76ab3b from RC-353 Simplify ruling snippets to use checked-out sources core-languages-tooling-public#87.
Retain the existing guava S9149 expectation test change already on this branch.

Validation

JSON validated; confirmed exactly one five-line issue shift per project in the new changes.
git diff --check passed.
Vortex DEEP analysis passed with no issues across the 12 changed files.
Ruling tests not run locally, per repository instructions.

Expected result

The ruling-diff workflow posts a PR comment showing the intentional expectation changes across all ruling projects.

github-actions · 2026-10-29T10:30:30Z

Ruling Diff Summary

Detected changes in 8 rule files: 8 issues removed, 8 issues added.

S103 (java) on commons-beanutils - 1 issues removed, 1 issues added

Removed src/main/java/org/apache/commons/beanutils2/BeanPropertyValueChangeClosure.java (line 129)

       124 |      * property path will genenerate an <code>IllegalArgumentException</code> or not.
       125 |      *
       126 |      * @param propertyName The name of the property that will be updated with the value specified by
       127 |      * <code>propertyValue</code>.
       128 |      * @param propertyValue The value that <code>propertyName</code> will be set to on the target
>>>    129 |      * object.
       130 |      * @param ignoreNull Determines whether <code>null</code> objects in the property path will
       131 |      * genenerate an <code>IllegalArgumentException</code> or not.
       132 |      * @throws IllegalArgumentException If the propertyName provided is null or empty.
       133 |      */
       134 |     public BeanPropertyValueChangeClosure(final String propertyName, final Object propertyValue, final boolean ignoreNull) {

Added src/main/java/org/apache/commons/beanutils2/BeanPropertyValueChangeClosure.java (line 134)

       129 |      * object.
       130 |      * @param ignoreNull Determines whether <code>null</code> objects in the property path will
       131 |      * genenerate an <code>IllegalArgumentException</code> or not.
       132 |      * @throws IllegalArgumentException If the propertyName provided is null or empty.
       133 |      */
>>>    134 |     public BeanPropertyValueChangeClosure(final String propertyName, final Object propertyValue, final boolean ignoreNull) {
       135 |         super();
       136 | 
       137 |         if (propertyName != null && propertyName.length() > 0) {
       138 |             this.propertyName = propertyName;
       139 |             this.propertyValue = propertyValue;

S100 (java) on eclipse-jetty - 1 issues removed, 1 issues added

Removed jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java (line 335)

(source file not found at this revision: jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java)

Added jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java (line 340)

(source file not found at this revision: jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java)

S100 (java) on guava - 1 issues removed, 1 issues added

Removed src/com/google/common/hash/Hashing.java (line 96)

        91 |   private static final int GOOD_FAST_HASH_SEED = (int) System.currentTimeMillis();
        92 | 
        93 |   /**
        94 |    * Returns a hash function implementing the
        95 |    * <a href="http://smhasher.googlecode.com/svn/trunk/MurmurHash3.cpp">
>>>     96 |    * 32-bit murmur3 algorithm, x86 variant</a> (little-endian variant),
        97 |    * using the given seed value.
        98 |    *
        99 |    * <p>The exact C++ equivalent is the MurmurHash3_x86_32 function (Murmur3A).
       100 |    */
       101 |   public static HashFunction murmur3_32(int seed) {

Added src/com/google/common/hash/Hashing.java (line 101)

        96 |    * 32-bit murmur3 algorithm, x86 variant</a> (little-endian variant),
        97 |    * using the given seed value.
        98 |    *
        99 |    * <p>The exact C++ equivalent is the MurmurHash3_x86_32 function (Murmur3A).
       100 |    */
>>>    101 |   public static HashFunction murmur3_32(int seed) {
       102 |     return new Murmur3_32HashFunction(seed);
       103 |   }
       104 | 
       105 |   /**
       106 |    * Returns a hash function implementing the

S109 (java) on java-time-example - 1 issues removed, 1 issues added

Removed src/main/java/example/AppointmentService.java (line 7)

         2 | 
         3 | import java.time.LocalDate;
         4 | import java.time.LocalDateTime;
         5 | import java.time.Month;
         6 | import java.time.MonthDay;
>>>      7 | import java.time.YearMonth;
         8 | 
         9 | public class AppointmentService {
        10 | 
        11 |   void schedule() {
        12 |     LocalDate.of(2024, 1, 10);

Added src/main/java/example/AppointmentService.java (line 12)

         7 | import java.time.YearMonth;
         8 | 
         9 | public class AppointmentService {
        10 | 
        11 |   void schedule() {
>>>     12 |     LocalDate.of(2024, 1, 10);
        13 |     LocalDate.of(2024, 2, 15);
        14 |     LocalDate.of(2024, 3, 20);
        15 |     LocalDate.of(2024, 4, 5);
        16 |     LocalDate.of(2024, Month.MAY, 1);
        17 |     LocalDate.of(2024, 6, 18);

S103 (java) on jboss-ejb3-tutorial - 1 issues removed, 1 issues added

Removed blob/src/org/jboss/tutorial/blob/bean/LobTesterBean.java (line 63)

        58 |          ObjectOutputStream oos = new ObjectOutputStream(baos);
        59 |          oos.writeObject(map);
        60 |          blob.setBlobby(Hibernate.createBlob(baos.toByteArray()));
        61 |       }
        62 |       catch (IOException e)
>>>     63 |       {
        64 |          throw new RuntimeException(e);
        65 |       }
        66 | 
        67 | 
        68 |       String clobby = "This is a very long string that will be stored in a java.sql.Clob hopefully.  We'll see how this works and if it will work" +

Added blob/src/org/jboss/tutorial/blob/bean/LobTesterBean.java (line 68)

        63 |       {
        64 |          throw new RuntimeException(e);
        65 |       }
        66 | 
        67 | 
>>>     68 |       String clobby = "This is a very long string that will be stored in a java.sql.Clob hopefully.  We'll see how this works and if it will work" +
        69 |       "This is a very long string that will be stored in a java.sql.Clob hopefully.  We'll see how this works and if it will work" +
        70 |       "This is a very long string that will be stored in a java.sql.Clob hopefully.  We'll see how this works and if it will work" +
        71 |       "This is a very long string that will be stored in a java.sql.Clob hopefully.  We'll see how this works and if it will work" +
        72 |       "This is a very long string that will be stored in a java.sql.Clob hopefully.  We'll see how this works and if it will work" +
        73 |       "This is a very long string that will be stored in a java.sql.Clob hopefully.  We'll see how this works and if it will work" +

S103 (java) on mall - 1 issues removed, 1 issues added

Removed mall-admin/src/main/java/com/macro/mall/config/MallSecurityConfig.java (line 38)

        33 |     }
        34 | 
        35 |     @Bean
        36 |     public DynamicSecurityService dynamicSecurityService() {
        37 |         return new DynamicSecurityService() {
>>>     38 |             @Override
        39 |             public Map<String, ConfigAttribute> loadDataSource() {
        40 |                 Map<String, ConfigAttribute> map = new ConcurrentHashMap<>();
        41 |                 List<UmsResource> resourceList = resourceService.listAll();
        42 |                 for (UmsResource resource : resourceList) {
        43 |                     map.put(resource.getUrl(), new org.springframework.security.access.SecurityConfig(resource.getId() + ":" + resource.getName()));

Added mall-admin/src/main/java/com/macro/mall/config/MallSecurityConfig.java (line 43)

        38 |             @Override
        39 |             public Map<String, ConfigAttribute> loadDataSource() {
        40 |                 Map<String, ConfigAttribute> map = new ConcurrentHashMap<>();
        41 |                 List<UmsResource> resourceList = resourceService.listAll();
        42 |                 for (UmsResource resource : resourceList) {
>>>     43 |                     map.put(resource.getUrl(), new org.springframework.security.access.SecurityConfig(resource.getId() + ":" + resource.getName()));
        44 |                 }
        45 |                 return map;
        46 |             }
        47 |         };
        48 |     }

S1134 (java) on regex-examples - 1 issues removed, 1 issues added

Removed src/main/java/org/regex/examples/RegexDatabase4.java (line 1979)

      1974 |     // https://github.com/mrdjun/fun-generator/blob/a9815a40ea29b4aa7ad1ff38f18f488b49034c30/generator/src/main/java/com/fun/generator/utils/TableParseUtil.java#L82
      1975 |     Pattern.compile("\\ COMMENT '(.*?)\\'"),
      1976 |     // https://github.com/mrdjun/fun-generator/blob/a9815a40ea29b4aa7ad1ff38f18f488b49034c30/generator/src/main/java/com/fun/generator/utils/TableParseUtil.java#L85
      1977 |     Pattern.compile("\\ COMMENT '|\\'"),
      1978 |     // https://github.com/mrdjun/fun-generator/blob/a9815a40ea29b4aa7ad1ff38f18f488b49034c30/generator/src/main/java/com/fun/generator/utils/TableParseUtil.java#L95
>>>   1979 |     Pattern.compile("[\\s]*PRIMARY KEY .*(\\),|\\))"),
      1980 |     // https://github.com/mrdjun/fun-generator/blob/a9815a40ea29b4aa7ad1ff38f18f488b49034c30/generator/src/main/java/com/fun/generator/utils/TableParseUtil.java#L96
      1981 |     Pattern.compile("[\\s]*UNIQUE KEY .*(\\),|\\))"),
      1982 |     // https://github.com/mrdjun/fun-generator/blob/a9815a40ea29b4aa7ad1ff38f18f488b49034c30/generator/src/main/java/com/fun/generator/utils/TableParseUtil.java#L97
      1983 |     Pattern.compile("[\\s]*KEY .*(\\),|\\))"),
      1984 |     // https://github.com/Pin-Chyan/fixme/blob/7eb0590f080b8dc838114c40b692cfd1bc5bc432/broker/src/main/java/com/endlesshorizon/broker/Broker.java#L171

Added src/main/java/org/regex/examples/RegexDatabase4.java (line 1984)

      1979 |     Pattern.compile("[\\s]*PRIMARY KEY .*(\\),|\\))"),
      1980 |     // https://github.com/mrdjun/fun-generator/blob/a9815a40ea29b4aa7ad1ff38f18f488b49034c30/generator/src/main/java/com/fun/generator/utils/TableParseUtil.java#L96
      1981 |     Pattern.compile("[\\s]*UNIQUE KEY .*(\\),|\\))"),
      1982 |     // https://github.com/mrdjun/fun-generator/blob/a9815a40ea29b4aa7ad1ff38f18f488b49034c30/generator/src/main/java/com/fun/generator/utils/TableParseUtil.java#L97
      1983 |     Pattern.compile("[\\s]*KEY .*(\\),|\\))"),
>>>   1984 |     // https://github.com/Pin-Chyan/fixme/blob/7eb0590f080b8dc838114c40b692cfd1bc5bc432/broker/src/main/java/com/endlesshorizon/broker/Broker.java#L171
      1985 |     Pattern.compile("(\\d{6})"),
      1986 |     // https://github.com/mygithub-xu/blog/blob/2f4a3c4823953b1bfc7dc978d72687269fe686c3/java/src/main/java/com/dhlg/utils/common/StringUtils.java#L362
      1987 |     Pattern.compile("[\u4E00-\u9FA5]"),
      1988 |     // https://github.com/mygithub-xu/blog/blob/2f4a3c4823953b1bfc7dc978d72687269fe686c3/java/src/main/java/com/dhlg/utils/common/StringUtils.java#L376
      1989 |     Pattern.compile("amp;"),

NoSonar (java) on sonarqube-6.5 - 1 issues removed, 1 issues added

Removed src/main/java/org/sonar/server/ui/PageDecorations.java (line 41)

(source file not found at this revision: src/main/java/org/sonar/server/ui/PageDecorations.java)

Added src/main/java/org/sonar/server/ui/PageDecorations.java (line 46)

(source file not found at this revision: src/main/java/org/sonar/server/ui/PageDecorations.java)

github-actions · 2026-10-29T10:38:52Z

⚖️ Ruling update ready for review: #6431

datadog-sonarsource · 2026-10-29T10:47:23Z

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 4 Pipeline jobs failed

Build | Ruling QA (warp-custom-windows-2022-l, without-sonarqube-project, LATEST_RELEASE) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Build | Ruling QA (warp-custom-windows-2022-m, only-sonarqube-project, LATEST_RELEASE) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Build | Ruling QA (warp-custom-ubuntu-24-04, only-sonarqube-project, LATEST_RELEASE)

View more details · View in GitHub Actions

View all 4 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 47a8da3 | Docs | View more details | Give us feedback!}

github-actions · 2026-10-29T10:54:25Z

⚖️ Ruling update ready for review: #6431

gitar-bot · 2026-10-29T11:02:30Z

CI failed: Ruling QA jobs fail because expected ruling snapshots were deleted in this PR, so generated results (e.g. 52,108 issue differences for sonarqube-6.5) have no baseline to match; one additional job's failure is only partly visible in the logs.

Overview

Two unique failure patterns were found across 8 analyzed logs (3 templates). The clearest failure is JavaRulingTest.sonarqube_server on Windows, which reported Issues differences: 52108 because the expected sonarqube-6.5 ruling directory is missing. The other template's visible log shows report generation succeeding, but the actual test result is cut off, so its failure is inferred rather than confirmed.

Failures

Missing expected ruling baseline for sonarqube-6.5 (confidence: high)

Type: test
Affected jobs: 123406495541
Related to change: yes
Root cause: The log warns Directory not found: its/ruling/src/test/resources/expected/sonarqube-6.5, and JavaRulingTest.assertNoDifferences (JavaRulingTest.java:569) fails with Issues differences: 52108. The PR deletes the expected ruling files for this project, leaving nothing to compare against.
Suggested fix: Restore the its/ruling/src/test/resources/expected/sonarqube-6.5 expected results, or regenerate and commit them, then rerun its/ruling JavaRulingTest.sonarqube_server.

Ruling comparison against outdated expected snapshots (confidence: medium)

Type: test
Affected jobs: 123406495564, 123406495510
Related to change: yes
Root cause: The visible log shows diff report generation and artifact upload succeeding, but the test result is omitted from the excerpt. The PR deletes expected SonarQube ruling JSON files and changes other expected snapshots, so a mismatch is likely but not confirmed.
Suggested fix: Inspect the full ruling test output in the its/ruling/target diff report, then restore or update the expected snapshots under its/ruling/src/test/resources/expected/ and rerun the ruling tests.

Summary

Change-related failures: 2 findings, both linked to this PR's deletion and modification of expected ruling snapshots. One is confirmed by a concrete assertion (52,108 differences); the other is medium confidence because its test output was truncated.
Infrastructure/flaky failures: None identified. Cache and secret-retrieval steps succeeded or were skipped.
Recommended action: Restore or regenerate the expected ruling results for the affected projects (starting with sonarqube-6.5), confirm the full output for the other ruling job, then rerun the ruling QA jobs.

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Deleting 187 SonarQube 6.5 ruling fixtures and changing CI action pins could reduce regression coverage or alter PR-diff reporting.

Test PR that moves one expected issue five lines up across the 11 ruling expectation files and pins the ruling-diff-comment action to a new commit. The previously flagged missing-source placeholders for nested submodules were resolved, and no open issues remain.

✅ 1 closed

✅ Cross-PR: Pinned action shows missing-source placeholders for nested submodules

📄 .github/workflows/ruling-diff-comment.yml:41 📄 .github/workflows/ruling-diff-comment.yml:50
Breaks when this PR's action pin runs before #6421's recursive-submodule checkout lands on this branch, and a shifted issue sits in a project that lives in a nested submodule under its/sources.

How

.github/workflows/ruling-diff-comment.yml:50 pins the action to the core-languages-tooling-public#87 revision. That revision reads snippets only from the local checkout and no longer fetches missing submodule sources.

The same workflow checks out with submodules: true (.github/workflows/ruling-diff-comment.yml:41), which is not recursive. README.md:146 and .github/workflows/build.yml:87 both need --init --recursive / submodules: recursive to get the full ruling sources.

RC-789 Fix comment diff #6421 changes .github/workflows/ruling-diff-comment.yml:41 to a recursive checkout because some ruling files are not found without it.

Without that change, nested-submodule source files are missing. The comment then shows missing-source placeholders instead of the snippets this PR is supposed to demonstrate across all projects.

Fix

This PR: Set submodules: recursive on the checkout step next to the new pin, or rebase onto RC-789 Fix comment diff #6421.

RC-789 Fix comment diff #6421: Nothing needed. Its recursive checkout is what the pinned action requires.

Compared 6ddedf2 with #6421 at f1f19f0

Verification Rules 3/3 met PRs 4 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 4 inspected

Cross-PR 4 PRs inspected 0 open impacts

PR 87: RC-353 Simplify ruling snippets to use checked-out sources Inspected
PR 6421: RC-789 Fix comment diff Inspected
PR 6418: RC-353 Test Sarif diff Inspected
PR 85: RC-354: Expectation update tool improvements Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

sonarqube-next · 2026-10-29T11:05:31Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

github-actions · 2026-10-29T11:13:28Z

⚖️ Ruling update ready for review: #6431

github-actions · 2026-11-06T02:33:50Z

This PR is stale because it has been open 7 days with no activity. If there is no activity in the next 7 days it will be closed automatically

gitar-bot Bot reviewed Oct 29, 2026

View reviewed changes

Comment thread .github/workflows/ruling-diff-comment.yml Resolved

Test ruling diff action across all ruling projects

2e54558

romainbrenguier force-pushed the romain/test-ruling-diff branch from 6ddedf2 to 2e54558 Compare October 29, 2026 10:29

Check out nested ruling source submodules for diff snippets

70e82ad

github-actions Bot mentioned this pull request Oct 29, 2026

Update ruling results for PR #6429 #6431

Open

BartLucien and others added 2 commits October 29, 2026 11:55

Use unrelease version of tools

70c136f

Remove expected sonarqube ruling to get them regenerated

47a8da3

gitar-bot Bot mentioned this pull request Oct 29, 2026

RC-353 Add sarif and remove legacy json support to diff SonarSource/core-languages-tooling-public#89

Merged

github-actions Bot added the stale label Nov 6, 2026

romainbrenguier closed this Nov 6, 2026

Navigation Menu

Repository navigation

Test ruling-diff action across all ruling projects - #6429

Test ruling-diff action across all ruling projects#6429
romainbrenguier wants to merge 4 commits into
masterfrom
romain/test-ruling-diff

romainbrenguier commented Oct 29, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

datadog-sonarsource Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

gitar-bot Bot commented Oct 29, 2026 •

edited

Loading

Overview

Failures

Missing expected ruling baseline for sonarqube-6.5 (confidence: high)

Ruling comparison against outdated expected snapshots (confidence: medium)

Summary

Uh oh!

sonarqube-next Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Nov 6, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

romainbrenguier commented Oct 29, 2026

Purpose

Changes

Validation

Expected result

Uh oh!

Uh oh!

github-actions Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ruling Diff Summary

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

datadog-sonarsource Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Errors

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

gitar-bot Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Failures

Missing expected ruling baseline for sonarqube-6.5 (confidence: high)

Ruling comparison against outdated expected snapshots (confidence: medium)

Summary

Uh oh!

sonarqube-next Bot commented Oct 29, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Nov 6, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Oct 29, 2026 •

edited

Loading

datadog-sonarsource Bot commented Oct 29, 2026 •

edited

Loading

gitar-bot Bot commented Oct 29, 2026 •

edited

Loading