SONARJAVA-6711 USER-2405 Fix S3252 false positive for Quarkus Panache entity static methods

[romainbrenguier]

Panache uses bytecode generation to create static method implementations in entity subclasses, so accessing them via the derived type is the intended usage pattern. Skip the issue when the static member's owner is a Panache entity base class.

Part of

[hashicorp-vault-sonar-prod]

SONARJAVA-6711

[gitar-bot]

CI failed: The CI build failed due to an infrastructure outage (HTTP 503 Service Unavailable) when the SonarQube scanner attempted to query the server version.

Overview

1 log failure was analyzed across 1 job. The failure was entirely caused by an external infrastructure glitch where the SonarQube analysis server returned a 503 error.

Failures

SonarQube Server Unavailable (confidence: high)

• Type: infrastructure
• Affected jobs: 91682807106
• Related to change: no
• Root cause: The sonar-maven-plugin failed to bootstrap because a GET request to query the SonarQube server version received an HTTP 503 Service Unavailable response.
• Suggested fix: Rerun the CI job once the SonarQube server recovers or completes maintenance.

Summary

• Change-related failures: 0
• Infrastructure/flaky failures: 1 failure due to SonarQube server HTTP 503 availability issue.
• Recommended action: Re-trigger the CI pipeline as the failure is external and unrelated to the PR changes.

Code Review 👍 Approved with suggestions 0 resolved / 1 findings

Fixes S3252 false positives for Quarkus Panache entity static methods by skipping checks on Panache entity base classes. Consider narrowing the isPanacheEntityBase scope so it doesn't suppress warnings for user-defined static members.

💡 Quality: Panache suppression broader than bytecode-generated methods

_{Reply with Gitar … to ask about this finding.}

isPanacheEntityBase(staticType) suppresses S3252 for any static member whose declaring type is a Panache entity base subtype — not only the framework-generated methods (listAll/count/etc.). A user-declared static method inherited from a Panache-derived class and accessed via a further subclass would also be silently skipped, introducing a false negative. This is acceptable for the fix but consider narrowing to the known Panache base classes themselves (e.g. checking the exact owner FQN) if tighter scoping is desired.

🤖 Prompt for agents

Code Review: Fixes S3252 false positives for Quarkus Panache entity static methods by skipping checks on Panache entity base classes. Consider narrowing the isPanacheEntityBase scope so it doesn't suppress warnings for user-defined static members.

1. 💡 Quality: Panache suppression broader than bytecode-generated methods

   isPanacheEntityBase(staticType) suppresses S3252 for any static member whose declaring type is a Panache entity base subtype — not only the framework-generated methods (listAll/count/etc.). A user-declared static method inherited from a Panache-derived class and accessed via a further subclass would also be silently skipped, introducing a false negative. This is acceptable for the fix but consider narrowing to the known Panache base classes themselves (e.g. checking the exact owner FQN) if tighter scoping is desired.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}