sonar-workflow

Files (1)

• SKILL.md

SKILL.md (first lines)

# SonarQube Quality Workflow

This skill helps fix SonarQube code quality issues for a pull request by prioritizing issues, auto-fixing trivial problems, and requesting approval for complex changes.

## When to Use

- After creating a PR when SonarQube analysis is available
- When asked to "fix SonarQube issues" or "improve code quality"
- When quality gate is failing on a PR

## Prerequisites

- PR must exist for current branch
- SonarQube project configured in `sonar-project.properties`
- SonarQube analysis completed for the PR

## Issue Classification

### Trivial (Auto-fix without approval)

- Severity: `INFO` or `LOW`
- Type: Code smell only
- Single-file changes
- Impact: `MAINTAINABILITY` only
- Keywords: "unused", "console.log", "formatting", "whitespace", "empty", "import order"

### Complex (User approval required)

- All security hotspots
- Severity: `HIGH`, `BLOCKER`, `CRITICAL`
- Type: Bug, Vulnerability
- Coverage gaps (requires test writing)
- Code duplications (requires refactoring)
- Medium severity affecting multiple files

## Workflow

### 1. Verify PR Exists

Check if PR exists for current branch:

```bash
gh pr list --head "$(git branch --show-current)" --state open
```

Exit if no PR found with message: "No PR found for current branch. Create PR first using pr-workflow skill."

Extract PR number from output.

### 2. Get PR Details

```bash
gh pr view <pr-number> --json number,headRefName,baseRefName
```

Extract: PR number, branch name, base branch.

### 3. Get SonarQube Project Key

```bash
grep "^sonar.projectKey=" sonar-project.properties | cut -d'=' -f2
```

Use the extracted project key for all SonarQube operations.

Verify project exists using `search_my_sonarqube_projects`.

### 4. Fetch Issues by Priority

Process in strict priority order:

#### a. Security Hotspots (Highest Priority)

```bash
# Tool: search_security_hotspots(projectKey, pullRequest, status=["TO_REVIEW"])
# For each: show_security_hotspot(hotspotKey)
```

Classification: Always complex (require approval).

#### b. BLOCKER/HIGH Issues

```bash
# Tool: search_sonar_issues_in_projects(projects=[projectKey], pullRequestId, severities=["BLOCKER","HIGH"])
# For each: show_rule(ruleKey) for remediation guidance
```

Classification: Always complex (require approval).

#### c. Coverage Issues

```bash
# Tool: search_files_by_coverage(projectKey, pullRequest, maxCoverage=70)
# For each: get_file_coverage_details(fileKey, pullRequest)
```

Classification: Always complex (requires test writing).

#### d. Code Duplications

```bash
# Tool: search_duplicated_files(projectKey, pullRequest)
# For each with >5% duplication: get_duplications(fileKey, pullRequest)
```

Classification: Always complex (requires refactoring).

#### e. MEDIUM/LOW/INFO Issues

```bash
# Tool: search_sonar_issues_in_projects(projects=[projectKey], pullRequestId, severities=["MEDIUM","LOW","INFO"])
# For each: show_rule(ruleKey)
```

Classification: Apply trivial vs complex logic based on rule keywords and type.

### 5. Categorize Issues

For each issue:

From rabihkodeih/agentic-workflow, MIT.

More from rabihkodeih/agentic-workflow