From 5e2eff0db2a2f39d67a9be0757e50f28e55c3416 Mon Sep 17 00:00:00 2001 From: redcatbear Date: Wed, 6 May 2026 08:46:02 +0200 Subject: [PATCH 1/7] #31: Added auto-complete for coverage tags. --- buildSrc/build.gradle.kts | 7 +- buildSrc/gradle.properties | 2 + .../pr-fix-sonarcloud-open-findings.md | 177 + doc/design/quality_requirements.md | 2 + gradle/verification-metadata.xml | 3185 +++++++++++++++++ .../OftDeclarationNavigationElement.java | 4 - .../OftSpecificationCompletionProvider.java | 18 +- .../trace/OftTraceInputResolver.java | 83 +- .../trace/OftTraceNavigationResolver.java | 2 +- .../trace/OftTraceProjectConfigurable.java | 6 + .../intellijplugin/trace/OftTraceService.java | 4 +- .../trace/OftTraceSettingsSnapshot.java | 6 +- .../OftTraceProjectConfigurableTest.java | 8 +- 13 files changed, 3456 insertions(+), 48 deletions(-) create mode 100644 buildSrc/gradle.properties create mode 100644 doc/changesets/pr-fix-sonarcloud-open-findings.md create mode 100644 gradle/verification-metadata.xml diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts index 2e4b966..e9755a5 100644 --- a/buildSrc/build.gradle.kts +++ b/buildSrc/build.gradle.kts @@ -6,10 +6,13 @@ repositories { mavenCentral() } +val junitBomVersion = providers.gradleProperty("junitBomVersion") +val hamcrestVersion = providers.gradleProperty("hamcrestVersion") + dependencies { - testImplementation(platform("org.junit:junit-bom:5.13.1")) + testImplementation(platform("org.junit:junit-bom:${junitBomVersion.get()}")) testImplementation("org.junit.jupiter:junit-jupiter") - testImplementation("org.hamcrest:hamcrest:3.0") + testImplementation("org.hamcrest:hamcrest:${hamcrestVersion.get()}") testRuntimeOnly("org.junit.platform:junit-platform-launcher") } diff --git a/buildSrc/gradle.properties b/buildSrc/gradle.properties new file mode 100644 index 0000000..809dddc --- /dev/null +++ b/buildSrc/gradle.properties @@ -0,0 +1,2 @@ +junitBomVersion=5.13.1 +hamcrestVersion=3.0 diff --git a/doc/changesets/pr-fix-sonarcloud-open-findings.md b/doc/changesets/pr-fix-sonarcloud-open-findings.md new file mode 100644 index 0000000..600865b --- /dev/null +++ b/doc/changesets/pr-fix-sonarcloud-open-findings.md @@ -0,0 +1,177 @@ +# PR Fix SonarCloud Open Findings + +## Goal + +Close the 23 open or confirmed SonarCloud findings currently reported for the +`org.itsallcode.openfasttrace:openfasttrace-intellij-plugin` project without +adding user-visible plugin behavior. + +The pull request should keep the cleanup compact: fix straightforward code +smells directly, add only narrow analyzer suppressions when a finding conflicts +with IntelliJ Platform API requirements or the documented OpenFastTrace runtime +design, and leave unrelated refactoring for later. + +## Scope + +In scope: + +* fix the current SonarCloud findings from the open/confirmed issue view +* preserve existing completion, navigation, trace configuration, and trace + execution behavior +* add predictable Gradle dependency metadata accepted by SonarCloud +* remove hard-coded dependency versions from `buildSrc/build.gradle.kts` +* keep implementation changes covered by existing focused tests, extending tests + only where behavior-preserving refactoring needs protection +* avoid new third-party dependencies + +Out of scope: + +* changing SonarCloud quality profiles, quality gates, issue severities, or + project permissions +* adding new plugin features or changing end-user workflows +* broad package restructuring unrelated to the reported findings +* changing OpenFastTrace, IntelliJ Platform, or OSS Index policy beyond what the + findings require +* version or changelog updates unless implementation work introduces a + user-visible behavior change + +## Design References + +* [System Requirements](../system_requirements.md) +* [Building Block View](../design/building_block_view.md) +* [Runtime View](../design/runtime_view.md) +* [Quality Requirements](../design/quality_requirements.md) + +## Strategy + +Treat this as static-analysis and security-gate cleanup. The product +requirements and runtime design should remain unchanged unless a finding exposes +an actual behavior defect. + +Prefer small refactorings over suppressions. Use a suppression only when the +Sonar rule conflicts with a deliberate project or platform constraint, for +example IntelliJ's `Configurable.apply()` validation contract or the explicit +plugin class loader required for OpenFastTrace `ServiceLoader` discovery. Put +the reason next to the suppression so future cleanup does not need to rediscover +the context. + +## SonarCloud Findings To Close + +Build and dependency metadata: + +* `build.gradle.kts`: add Gradle dependency locking or verification metadata so + dependency versions are predictable (`text:S8569`) +* `buildSrc/build.gradle.kts`: move hard-coded test dependency versions out of + the build script (`kotlin:S6624`) + +Completion and navigation: + +* `OftSpecificationCompletionProvider`: split complex comment-marker detection + and finish the quote-state branching with an explicit default path + (`java:S1067`, `java:S126`) +* `OftTraceNavigationResolver`: make private helper methods static where they do + not access instance state (`java:S2325`) +* `OftDeclarationNavigationElement`: remove the unnecessary + `serialVersionUID` field (`java:S4926`) + +Trace configuration and input resolution: + +* `OftTraceProjectConfigurable`: preserve or log invalid-path exceptions and + resolve the checked `ConfigurationException` findings without weakening IDE + settings validation (`java:S1166`, `java:S1162`) +* `OftTraceInputResolver`: split long lines, reduce nested control flow when + resolving source folders, and preserve or log invalid-path exceptions + (`java:S103`, `java:S134`, `java:S1166`) +* `OftTraceSettingsSnapshot`: precompile the line-splitting pattern + (`java:S4248`) + +Trace execution: + +* `OftTraceService`: make `buildInputHeader` static and resolve the class-loader + finding in a way that keeps the documented OpenFastTrace `ServiceLoader` + behavior intact (`java:S2325`, `java:S3032`) + +Tests: + +* `OftTraceProjectConfigurableTest`: replace boolean literal assertions with + `assertTrue` and `assertFalse` (`java:S2701`) + +## Task List + +- [x] Create and checkout a new Git branch `quality/fix-sonarcloud-open-findings` + +### Requirements And Design + +- [x] Confirm no `doc/system_requirements.md` change is needed because the PR is + behavior-preserving cleanup +- [x] Update `doc/design/quality_requirements.md` so committed Gradle dependency + verification metadata is an ongoing dependency-policy requirement +- [x] Confirm no runtime design change is needed because implementation preserves + trace execution, trace configuration, completion, and navigation semantics + +### Implementation + +- [x] Add Gradle dependency locking or dependency verification metadata and keep + it committed +- [x] Move `buildSrc` dependency versions to project properties or equivalent + centralized Gradle metadata +- [x] Refactor completion-provider comment and quote detection to satisfy + complexity and branching rules without broadening completion activation +- [x] Refactor trace input resolution to reduce nesting, split long lines, and + preserve exception context +- [x] Keep trace configuration validation compatible with IntelliJ settings UI + while closing or narrowly suppressing checked-exception findings +- [x] Apply the small static-method, regex-pattern, serial-field, and assertion + cleanups +- [x] Keep OpenFastTrace coverage tags accurate for changed implementation and + test code + +### Verification + +- [x] Run `./gradlew test` +- [x] Run `./gradlew traceRequirements` +- [x] Run `./gradlew check` +- [x] Run `./gradlew buildPlugin` +- [x] Run `./gradlew verifyPlugin` and record any remaining pre-existing + verifier findings if it is not green +- [ ] Run `./gradlew --no-configuration-cache sonar` when a valid + Sonar token is available; otherwise rely on the SonarCloud PR analysis to + prove the findings are closed +- [ ] Keep OSS Index audit results clean when credentials and service quota are + available + +`./gradlew --warning-mode=all buildSrc:test` passes. + +`./gradlew test` passes. + +`./gradlew traceRequirements` passes. + +`./gradlew traceRequirements` passes after adding the dependency verification +metadata maintenance policy. + +`./gradlew check` passes, including `spotlessCheck`, `traceRequirements`, +tests, and path coverage verification. + +`./gradlew buildPlugin` passes. + +`./gradlew verifyPlugin` still fails because of pre-existing IntelliJ Platform +experimental API usage in `OftHighlightingPass` and internal API usage in +`OftTraceRunContentOutputPresenter`. The verifier reports the plugin as +compatible otherwise. + +`./gradlew sonarWholeProject -Dsonar.skip=true` was attempted but the task is +not available on this branch. + +`./gradlew --no-configuration-cache sonar -Dsonar.skip=true` passes and +confirms the existing Sonar task still prepares test and JaCoCo XML inputs +before the skipped analysis. + +A real Sonar upload was not run because this shell has no `SONAR_TOKEN`. + +An OSS Index audit was not run because this shell has no `OSSINDEX_USERNAME` and +`OSSINDEX_TOKEN`. + +## Version And Changelog Update + +- [x] Do not raise the version or update the changelog unless the implementation + introduces a user-visible behavior change diff --git a/doc/design/quality_requirements.md b/doc/design/quality_requirements.md index 2123ce0..289605e 100644 --- a/doc/design/quality_requirements.md +++ b/doc/design/quality_requirements.md @@ -55,6 +55,8 @@ The plugin uses the minimum set of dependencies required for: Additional libraries are not allowed by default. Any new third-party dependency requires an explicit design decision and approval before it is added to the build. +The Gradle dependency verification metadata in `gradle/verification-metadata.xml` is committed to source control. Maintainers update and review this metadata whenever dependency declarations, Gradle plugin versions, the IntelliJ Platform version, or other build inputs change the resolved dependency artifacts. The standard update command is `./gradlew --write-verification-metadata sha256 help`. + ## Static Analysis And Security Gates Static code analysis runs in SonarQube Cloud and acts as a build breaker. A failing quality gate blocks integration until the reported issues are resolved or an approved exception exists. diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml new file mode 100644 index 0000000..fe66871 --- /dev/null +++ b/gradle/verification-metadata.xml @@ -0,0 +1,3185 @@ + + + + true + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/main/java/org/itsallcode/openfasttrace/intellijplugin/navigation/OftDeclarationNavigationElement.java b/src/main/java/org/itsallcode/openfasttrace/intellijplugin/navigation/OftDeclarationNavigationElement.java index 17a44c1..ef1869d 100644 --- a/src/main/java/org/itsallcode/openfasttrace/intellijplugin/navigation/OftDeclarationNavigationElement.java +++ b/src/main/java/org/itsallcode/openfasttrace/intellijplugin/navigation/OftDeclarationNavigationElement.java @@ -13,13 +13,9 @@ import org.jspecify.annotations.NonNull; import javax.swing.Icon; -import java.io.Serial; import java.util.Objects; final class OftDeclarationNavigationElement extends FakePsiElement { - @Serial - private static final long serialVersionUID = 1L; - private final transient PsiElement delegate; private final OftIndexedSpecification specification; diff --git a/src/main/java/org/itsallcode/openfasttrace/intellijplugin/navigation/OftSpecificationCompletionProvider.java b/src/main/java/org/itsallcode/openfasttrace/intellijplugin/navigation/OftSpecificationCompletionProvider.java index 23bf17e..43f2fec 100644 --- a/src/main/java/org/itsallcode/openfasttrace/intellijplugin/navigation/OftSpecificationCompletionProvider.java +++ b/src/main/java/org/itsallcode/openfasttrace/intellijplugin/navigation/OftSpecificationCompletionProvider.java @@ -20,6 +20,7 @@ import org.itsallcode.openfasttrace.intellijplugin.indexing.OftIndexedSpecification; import java.util.Optional; +import java.util.Set; // [impl->dsn~specification-item-completion~1] // [impl->dsn~complete-specification-item-id-in-covers-section~1] @@ -29,6 +30,9 @@ // [impl->dsn~complete-specification-item-id-in-incomplete-coverage-tag-target~1] // [impl->dsn~suppress-coverage-tag-target-completion-outside-target-context~1] public final class OftSpecificationCompletionProvider extends CompletionContributor implements DumbAware { + private static final Set FALLBACK_TEXT_COMMENT_MARKERS = + Set.of("//", "#", "--", ";", "'", "/*", "