[BartLucien]

---

Summary by Gitar

• Test expectations:
  • Removed 28 expected findings from java-S103.sarif in the guava ruling expectations
  • Removed 28 expected findings from java-S100.sarif in the eclipse-jetty ruling expectations

_{This will update automatically on new commits.}

[github-actions]

⚖️ Ruling update ready for review: #6420

[datadog-sonarsource]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 3 Pipeline jobs failed

Build | Ruling QA (warp-custom-windows-2022-l, without-sonarqube-project, LATEST_RELEASE) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Build | Ruling QA (warp-custom-ubuntu-24-04, without-sonarqube-project, LATEST_RELEASE)

View more details · View in GitHub Actions

Build | Ruling Update and Notify

View more details · View in GitHub Actions

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 03e016e | Docs | View more details | Give us feedback!}

[github-actions]

⚖️ Ruling update ready for review: #6427

[github-actions]

⚖️ Ruling update ready for review: #6427

[github-actions]

⚖️ Ruling update ready for review: #6427

[gitar-bot]

CI failed: The Guava ruling integration test (JavaRulingTest.guava) fails because an expected S103 issue points to offset 43 on line 306 of Collections2.java, which has only 15 characters; the missing ruling-artifact upload is a downstream cascade. Relation to this PR is unclear since the PR touches the Guava S103 expected data.

Overview

Two CI failure templates were analyzed across 9 logs (commit 03e016e). Both reduce to one root cause: the Guava ruling test aborts in LITS when an expected range is invalid. No warnings-only findings were included.

Failures

Invalid expected S103 range for Guava Collections2.java:306 (confidence: high)

• Type: test
• Affected jobs: 123403424122, 123410103629
• Related to change: unclear
• Root cause: During JavaRulingTest.guava, LITS DumpPhase.expectedRange (via createMissingIssues) builds a pointer at offset 43 on line 306 of its/sources/guava/src/com/google/common/collect/Collections2.java, but that line has only 15 characters. The sonar-maven-plugin fails with 43 is not a valid line offset for pointer, and surefire reports it-java-ruling with 1 error out of 7 tests.
• Suggested fix: Inspect the Guava expected ruling data loaded by LITS, particularly its/ruling/src/test/resources/expected/guava/java-S103.sarif, and correct or remove the entry whose range uses offset 43 on Collections2.java:306 so it matches the current source. Then rerun JavaRulingTest.guava. The PR touches the same S103 expected data, but the supplied diff stats do not confirm whether this stale location was introduced or left behind, so the relationship is unverified.

Missing ruling results artifact (confidence: high)

• Type: test
• Affected jobs: 123403424122, 123410103629
• Related to change: unclear
• Root cause: The stage step reports No generated ruling directory found because the Guava test failed before writing actual results. The upload and diff-report steps were skipped as a consequence.
• Suggested fix: No separate fix is needed. Resolving the invalid Guava expected range should allow the ruling output directory to be generated. Verify that its/ruling/target/actual (or the equivalent build path) exists after the rerun.

Summary

• Change-related failures: 0 confirmed. The Guava invalid-range failure is marked unclear against this PR because it touches the Guava S103 expected data without confirmed causation.
• Infrastructure/flaky failures: none identified.
• Recommended action: Check the Guava S103 expected SARIF entries for the Collections2.java line 306 range (offset 43 is past the 15-character line end). Correct or remove that entry, then rerun the Guava ruling test. Treat the artifact-upload failure as a consequence of the test failure.

Code Review ✅ Approved 1 closed / 1 findings

🟢 Low risk · Removing 28 Guava expected findings updates ruling-test fixtures, with no evidence of runtime analyzer or public-interface changes.

Test-expectation cleanup removing 28 findings each from the guava java-S103.sarif and eclipse-jetty java-S100.sarif ruling files. The previously flagged expected S100 issue deletion, made while the rule still raises it, has been addressed. No open issues found.

✅ 1 closed

✅ Bug: Expected S100 issue deleted while the rule still raises it

📄 its/ruling/src/test/resources/expected/eclipse-jetty/java-S100.sarif:97-98
This PR deletes the expected java:S100 result for jetty-util/.../security/UnixCrypt.java line 415 (cols 25-35), but it doesn't change the S100 check, its regex, or the eclipse-jetty sources. So the analyzer will still report that method-name issue. The ruling comparison in JavaRulingTest checks actual issues against src/test/resources/expected, so it will now see one unexpected issue and fail. If the goal is to exercise ruling-diff reporting (RC-353), that is fine on this throwaway branch. Otherwise, put the removed result back, or pair the removal with the rule or source change that actually makes the issue go away.

Verification Rules 1/1 met

Functional validation No results

Rules 1 passed 2 not applicable

✅ Repository license compliance

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[github-actions]

Ruling Diff Summary

Detected changes in 1 rule files: 1 issues removed, 0 issues added.

S103 (java) on guava - 1 issues removed, 0 issues added

Removed src/com/google/thirdparty/publicsuffix/PublicSuffixPatterns.java (line 53, column 1, end column 193)

        48 |    * If a hostname is not a key in the EXCLUDE map, and if removing its
        49 |    * leftmost component results in a name which is a key in this map, it is a
        50 |    * public suffix.
        51 |    */
        52 |   public static final ImmutableMap<String, PublicSuffixType> UNDER =
>>>     53 |       TrieParser.parseTrie("az?db?e&k?y??gp?h&k?s.mroftalp,?in?jf?k&c?f?u.hcs??li?m&j?m?z??nb?p&j.&a&mahokoy?yogan??ebok?i&adnes?kasawak??oroppas?uhsuykatik??n??r&b.mon?e??ug?w&k?z??yc?zm??");
        54 | 
        55 |   /**
        56 |    * The elements in this map would pass the UNDER test, but are known not to
        57 |    * be public suffixes and are thus excluded from consideration. Since it
        58 |    * refers to elements in UNDER of the same type, the type is actually not