SAP Commerce SonarQube

Overview

Use this skill to run a deterministic Sonar workflow: fetch, analyze, report, and fix in small safe batches.

Trigger Checklist

Use this skill when one or more are true:

• you need Sonar issues for a PR or branch
• you need a markdown tracking report
• you need issue-diff between two branches
• you need scripted autofix for supported rules

Setup

• Export SONAR_TOKEN in the shell before running scripts.
• Keep credentials out of chat, logs, and commits.

Progressive Disclosure

Load only what the task needs:

• references/sonar-api.md for API/auth parameter details
• references/quality-rules.md for SAP Commerce fix constraints
• references/workflow-examples.md for command templates
• references/autofix-rules.md for currently supported rules/wrappers
• references/gotchas.md for common fetch/autofix pitfalls

Workflow

1. Confirm scope: base-url, project-key, PR/branch, leak-period mode.
2. Fetch issues with scripts/sonar_fetch.py.
3. Generate/update report with scripts/sonar_report.py.
4. If needed, compare with scripts/sonar_diff.py.
5. Autofix one rule at a time via scripts/sonar_autofix.py (inspect list, then apply).
6. Resolve remaining issues manually using references/quality-rules.md.
7. Record exact fixes in the tracking report.

Fixing Rules

• Prefer small behavior-preserving changes over broad refactors.
• Do not silence rules with @SuppressWarnings or //NOSONAR.
• Keep each autofix batch scoped to a single rule.

Verification

• Run targeted checks after each fix batch when risk is non-trivial.
• Call out any unverifiable change explicitly in the report.