[romainbrenguier]

Summary

S9398 (Inner classes should not be declared inside interfaces) now uses a better heuristic to tell legitimate nested types from implementation code:

• Still reported: a concrete nested class that implements the enclosing interface. That is implementation code living inside the contract. With semantic it uses isSubtypeOf; without semantic it compares the names of the direct supertypes.
• No longer reported:
  • Helper types: classes that appear in the signature of a method declared by the enclosing interface (return type, parameter types, thrown exceptions, including inside type arguments and qualified names). These let the contract and its argument and result types live in the same file.
  • Builders: classes whose name ends with Builder.
• Any other concrete nested class is still reported (unchanged).

Notes

• Ruling expectations (eclipse-jetty, sonarqube-6.5) will probably change. Per the repo's process, the ruling PR is created automatically by CI.
• The RSPEC description should get an "Exceptions" section listing the helper and builder cases.

🤖 Generated with Claude Code

Agent workflow

Tool link: https://github.com/SonarSource/languages-experimental-tooling/tree/romain/my-tickets/personal/romain-brenguier
PR created using uv run create_with_claude.py SONARJAVA-7240.txt

PR updated using uv run update_with_claude.py --prompt "Implement the action plan described in the document /tmp/action_plan_romain/sonarjava-7240.txt." -a "/tmp/action_plan_romain/sonarjava-7240.txt" -g "claude"

PR updated using uv run update_with_claude.py --prompt "Implement the action plan described in the document /tmp/action_plan_romain/sonarjava-7240.txt." -a "/tmp/action_plan_romain/sonarjava-7240.txt" -g "claude"

Iterated on the PR with uv run ci_loop.py for 2 iterations.
✔️ The PR is now ready for review.

Addressed review comments in pr_report_6403.md using uv run address_reviews.py pr_report_6403.md

[hashicorp-vault-sonar-prod]

SONARJAVA-7240

[datadog-sonarsource]

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: defa482 | Docs | Give us feedback!}

[github-actions]

⚖️ Ruling update ready for review: #6404

[github-actions]

Ruling Diff Summary

Detected changes in 3 rule files: 10 issues removed, 0 issues added.

S9398 (java) on eclipse-jetty - 1 issues removed, 0 issues added

Removed jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslHandshakeListener.java (line 57)

(source file not found at this revision: jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslHandshakeListener.java)

S9398 (java) on eclipse-jetty-similar-to-main - 1 issues removed, 0 issues added

Removed jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslHandshakeListener.java (line 57)

(source file not found at this revision: jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslHandshakeListener.java)

S9398 (java) on sonarqube-6.5 - 8 issues removed, 0 issues added

Removed src/main/java/org/sonar/server/authentication/event/AuthenticationEvent.java (line 97)

(source file not found at this revision: src/main/java/org/sonar/server/authentication/event/AuthenticationEvent.java)

Removed src/main/java/org/sonar/server/computation/task/projectanalysis/filemove/FileSimilarity.java (line 28)

(source file not found at this revision: src/main/java/org/sonar/server/computation/task/projectanalysis/filemove/FileSimilarity.java)

Removed src/main/java/org/sonar/server/computation/task/projectanalysis/filemove/MovedFilesRepository.java (line 37)

(source file not found at this revision: src/main/java/org/sonar/server/computation/task/projectanalysis/filemove/MovedFilesRepository.java)

Removed src/main/java/org/sonar/server/es/IndexDefinition.java (line 31)

(source file not found at this revision: src/main/java/org/sonar/server/es/IndexDefinition.java)

Removed src/main/java/org/sonar/server/organization/BillingValidations.java (line 47)

(source file not found at this revision: src/main/java/org/sonar/server/organization/BillingValidations.java)

Removed src/main/java/org/sonar/server/organization/OrganizationCreation.java (line 120)

(source file not found at this revision: src/main/java/org/sonar/server/organization/OrganizationCreation.java)

Removed src/main/java/org/sonar/server/organization/OrganizationCreation.java (line 126)

(source file not found at this revision: src/main/java/org/sonar/server/organization/OrganizationCreation.java)

Removed src/main/java/org/sonar/server/permission/ws/template/DefaultTemplatesResolver.java (line 43)

(source file not found at this revision: src/main/java/org/sonar/server/permission/ws/template/DefaultTemplatesResolver.java)

[github-actions]

⚖️ Ruling update ready for review: #6405

[nathsou]

[nit] Generic helper types are still reported

interface GenericDto {
  Helper<String> helper();
  class Helper<T> {}
}

Helper is incorrectly reported despite being an interface return type. The collected Helper<String> symbol differs from the Helper<T> declaration, so signatureTypes.contains(classTree.symbol()) returns false. Normalize both symbols to their declarations or erased types before comparing, and add regression coverage for generic return and parameter types.

[gitar-bot]

Code Review ✅ Approved 2 closed / 2 findings

🟡 Medium risk · S9398 now exempts nested types used in method signatures and non-implementing classes ending in Builder, which could let implementation code evade the diagnostic.

Relaxes S9398 so helper types appearing in an enclosing interface's method signatures and classes named *Builder are no longer reported as nested inside interfaces. Helper detection now compares resolved symbols instead of simple names, so unrelated types no longer hide issues, and interface method signatures are scanned once rather than for every nested class. No open issues remain.

✅ 2 closed

✅ Edge Case: Helper detection matches simple names, so unrelated types hide issues

📄 java-checks/src/main/java/org/sonar/java/checks/InnerClassInInterfaceCheck.java:95-109
TypeNamesCollector.visitIdentifier adds every identifier in a method signature to a set of bare strings, and isHelperType only checks names.contains(className). That set also picks up package segments, the simple names of unrelated qualified types, and method type-parameter names. For example, interface Parser { Optional<org.other.Result> parse(); class Result {} } adds Result from org.other.Result, so the unused nested Result is treated as compliant and its issue is suppressed. implementsInterface already uses semantic types when they are available, so this matching can do the same: compare the resolved signature types' symbols with classTree.symbol(), and fall back to names only when the type is unknown.

✅ Performance: Interface method signatures are re-scanned for every nested class

📄 java-checks/src/main/java/org/sonar/java/checks/InnerClassInInterfaceCheck.java:60 📄 java-checks/src/main/java/org/sonar/java/checks/InnerClassInInterfaceCheck.java:100-105
visitNode calls isHelperType once per concrete nested class. Each call builds a new TypeNamesCollector and walks every method signature in the enclosing interface again, so the work is O(nested classes × methods) when the interface's set of signature names only needs to be built once. Fix: compute the name set once per interface, for example by caching it in a map keyed by the interface ClassTree and clearing that map in leaveFile.

Verification Rules 1/2 met Repos 4 inspected

Rules 1 failed 1 passed 1 not applicable

❌ Internal artifact registries - Workflows are configured with a non-approved internal development repox endpoint. Verify the configuration, or switch to an approved repox endpoint or the production Edge URL.
✅ Repository license compliance

Functional validation No results

Broader impact Repos 4 inspected

Cross-repo 4 repositories inspected 0 open impacts

SonarSource/sonarlint-intellij Inspected
SonarSource/sonar-java-symbolic-execution Inspected
SonarSource/sonarlint-language-server Inspected
SonarSource/sonarlint-vscode Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube