SONARJAVA-6205 Add an agentic focused quality profile for Java by dorian-burihabwa-sonarsource · Pull Request #5531 · SonarSource/sonar-java

dorian-burihabwa-sonarsource · 2026-03-20T12:45:26Z

No description provided.

hashicorp-vault-sonar-prod · 2026-03-20T12:45:40Z

sonar-review-alpha · 2026-03-20T15:56:50Z

Summary

This PR introduces a new quality profile "Sonar agentic AI" tailored for AI and agentic use cases in Java, while refactoring common profile logic to eliminate duplication.

Key changes:

New profile: JavaAgenticWayProfile provides a curated set of 467 rules optimized for agentic scenarios, excluding rules that conflict with AI-focused development patterns
Refactoring: Extracted profile registration logic into a new abstract base class BuiltInJavaQualityProfile, which both this profile and the existing "Sonar way" profile now inherit from
Plugin registration: The new profile is registered in JavaPlugin and will be available alongside "Sonar way"
Dependencies: Added commons-csv (1.14.1) for CSV-based profile generation tooling

What reviewers should know

Start here:

Review BuiltInJavaQualityProfile.java - This is the new base class that consolidates all the common profile logic. The template method pattern is used: define() calls the abstract methods getProfileName(), getPathToJsonProfile(), and isDefault().
Review JavaAgenticWayProfile.java - This is simple: just 30 lines that extend the base class and specify which JSON file to load.

Key differences from "Sonar way":

The agentic profile excludes 67 specific rules (see test: S101, S110, S114, S115, etc.) that are deactivated for AI/agentic patterns
It is NOT set as the default profile (isDefault() = false)

About the refactoring:

JavaSonarWayProfile was substantially simplified by moving ~100 lines of profile logic to the base class. All the external plugin integration (security rules, dataflow bug detection) is now centralized.
The base class uses reflection to conditionally load rules from sonar-security and dataflow bug detection plugins if available, with a FIXME noting this should eventually be replaced with a better registration mechanism (SONARJAVA-6207).

Testing:

JavaAgenticWayProfileTest verifies the profile has exactly 467 rules, is not default, and explicitly tests that the 67 excluded rules are NOT present
The test file includes a disabled utility method for generating profiles from CSV (likely for future tooling)

Dependencies:

commons-csv was added but the profile generation test is disabled; this appears to be for future use or exploratory code

Generate Walkthrough
Generate Diagram

🗣️ Give feedback

rombirli

LGTM! I just have two questions about external rules inclusion mechanism and the purpose of profileRegistrars

rombirli · 2026-03-23T07:05:44Z

sonar-java-plugin/src/main/java/org/sonar/plugins/java/QualityProfileUtils.java

+      for (ProfileRegistrar profileRegistrar : profileRegistrars) {
+        profileRegistrar.register(ruleKeys::addAll);
+      }


In test JavaAgenticWayProfileTest, profileRegistrars is always null and this part is never covered, is there a reason ?

rombirli · 2026-03-23T07:10:33Z

sonar-java-plugin/src/main/java/org/sonar/plugins/java/JavaAgenticWayProfile.java

+  public void define(Context context) {
+    NewBuiltInQualityProfile agenticWay = context.createBuiltInQualityProfile("AI Quality Profile", Java.KEY);
+    Set<RuleKey> ruleKeys = QualityProfileUtils.registerRulesFromJson(
+      "/org/sonar/l10n/java/rules/java/Agentic_way_profile.json",


This string constant could be extracted in a constant SONAR_AGENTIC_WAY_PATH like SONAR_WAY_PATH in JavaSonarWayProfile

rombirli · 2026-03-23T07:24:09Z

sonar-java-plugin/src/main/java/org/sonar/plugins/java/JavaAgenticWayProfile.java

+    ruleKeys.forEach(ruleKey -> agenticWay.activateRule(ruleKey.repository(), ruleKey.rule()));
+    agenticWay.done();
+  }


These lines and the creation of agenticWay (or sonarWay) are repeated in JavaSonarWayProfile, maybe it could be refactored in QualityProfileUtils

static void createQualityProfile(String title, Set<RuleKey> ruleKeys) { NewBuiltInQualityProfile way = context.createBuiltInQualityProfile(title, Java.KEY); ruleKeys.forEach(ruleKey -> way.activateRule(ruleKey.repository(), ruleKey.rule())); way.done(); } }

rombirli · 2026-03-23T07:28:31Z

sonar-java-plugin/src/main/java/org/sonar/plugins/java/JavaSonarWayProfile.java

Is there a reason this mechanism to include external rules is not present in JavaAgenticWayProfile? (Why the implementations diverge? Is there a justification?)

rombirli

Agentic_way_profile.json seems to be wrong

rombirli · 2026-03-23T07:37:00Z

...-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/Sonar_agentic_ai_profile.json

Is this file auto-generated from the CSV with a script? Could we add the script to the repo? It seems to be wrong!
S100 shouldn't be included according to the spreadsheet.

rombirli

LGTM i get the exact same json quality profile file, I still have 2 refactoring proposals :

use tsv format instead of csv to get rid of csv library (so we can simply split with '\t' instead of ';')
use a single class that take qp name and json path instead of duplicated logic (we could also get rid of qualityprofileutils.java and put everything in this class)

sonar-review-alpha

Conclusion: Clean refactoring overall — the base class extraction is well-done and the agentic profile is properly wired up. Two issues in the generator utility method worth fixing before someone uses it to regenerate the profile.

🗣️ Give feedback

sonar-review-alpha · 2026-03-26T11:29:08Z

sonar-java-plugin/src/test/java/org/sonar/plugins/java/JavaAgenticWayProfileTest.java

+        return fileName.substring(0, fileName.lastIndexOf('.'));
+      })
+      .collect(Collectors.toSet());
+  }


Path.endsWith(String) does not work like String.endsWith(String). On a Path, it checks whether the path ends with a complete path segment named exactly "_profile.json", not whether the filename string ends with that suffix. This predicate is always false, so profile JSON files (Sonar_way_profile.json, Agentic_way_profile.json, etc.) are never excluded from keysOfImplementedRules.

The bug is harmless today because profile filenames won't appear as rule IDs in the CSV, but the filter silently does nothing. Fix:

.filter(path -> !path.getFileName().toString().endsWith("_profile.json"))

Mark as noise

sonar-review-alpha · 2026-03-26T11:29:08Z

sonar-java-plugin/src/test/java/org/sonar/plugins/java/JavaAgenticWayProfileTest.java

+      Path.of("Path", "to", "your", "input.csv"),
+      RULE_DESCRIPTION_DIRECTORY.resolve("Agentic_way_profile.json"),
+      "AI Quality Profile"
+    );


generate_ai_quality_profile() is missing @Test. In JUnit 5, @Disabled without @Test is a no-op — the framework never discovers the method, so the annotation provides no documentation value and could mislead a future developer into thinking this was intentionally skipped rather than just a utility method. Either add @Test so @Disabled works as intended, or remove @Disabled and leave it as a plain utility method with a descriptive Javadoc comment.

Mark as noise

Refactored to re-use the same code to initialize quality profiles assuming that all DBD and security rules should be part of the new quality profile.

sonar-review-alpha

LGTM! ✅

🗣️ Give feedback

sonarqube-next · 2026-03-27T13:09:16Z

Quality Gate passed

Issues
0 New issues
1 Fixed issue
1 Accepted issue

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch 2 times, most recently from 37eb8d7 to 0dab089 Compare March 20, 2026 15:29

dorian-burihabwa-sonarsource marked this pull request as ready for review March 20, 2026 15:56

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch from 0dab089 to 31312fc Compare March 20, 2026 16:24

This comment was marked as resolved.

Sign in to view

rombirli self-requested a review March 23, 2026 06:52

rombirli approved these changes Mar 23, 2026

View reviewed changes

rombirli requested changes Mar 23, 2026

View reviewed changes

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch from e818473 to 35e7ca4 Compare March 23, 2026 17:02

rombirli approved these changes Mar 24, 2026

View reviewed changes

sonar-review-alpha bot reviewed Mar 26, 2026

View reviewed changes

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch from 06e2ee5 to b890cc6 Compare March 26, 2026 15:02

This comment was marked as resolved.

Sign in to view

dorian-burihabwa-sonarsource added 4 commits March 26, 2026 17:24

SONARJAVA-6205 Add an agentic focused quality profile for Java

c026cb6

SONARJAVA-6205 Add test script to generate profile from CSV file

1dd6abc

SONARJAVA-6205 Remove S100 from AI quality profile

67f3c77

SONARJAVA-6205 Include DBD and security rules as part of Agentic profile

7ed374a

Refactored to re-use the same code to initialize quality profiles assuming that all DBD and security rules should be part of the new quality profile.

dorian-burihabwa-sonarsource force-pushed the SONARJAVA-6205 branch from b890cc6 to 7ed374a Compare March 26, 2026 16:31

sonar-review-alpha bot reviewed Mar 26, 2026

View reviewed changes

SONARJAVA-6205 Rename profile to 'Sonar Agentic AI'

11be7ab

Conversation

dorian-burihabwa-sonarsource commented Mar 20, 2026

Uh oh!

hashicorp-vault-sonar-prod bot commented Mar 20, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonar-review-alpha bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What reviewers should know

Uh oh!

This comment was marked as resolved.

Uh oh!

rombirli left a comment

Choose a reason for hiding this comment

Uh oh!

rombirli Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli left a comment

Choose a reason for hiding this comment

Uh oh!

rombirli Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli left a comment

Choose a reason for hiding this comment

Uh oh!

sonar-review-alpha bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonar-review-alpha bot Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

sonar-review-alpha bot Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

sonar-review-alpha bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqube-next bot commented Mar 27, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hashicorp-vault-sonar-prod bot commented Mar 20, 2026 •

edited by atlassian bot

Loading

sonar-review-alpha bot commented Mar 20, 2026 •

edited

Loading