SONARJAVA-5397 Support the import of custom checkstyle issues

[aurelien-coet-sonarsource]

---

Summary by Gitar

• External Reports:
  • Added support for importing custom checkstyle issues without the standard prefix in CheckstyleXmlReportReader.java

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-5397

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Added support for importing custom checkstyle issues without the standard prefix in CheckstyleXmlReportReader.java. The handling of empty 'source' attributes that previously required guards has been addressed.

✅ 1 resolved

✅ Edge Case: Empty 'source' attribute no longer guarded, yields blank rule key

📄 external-reports/src/main/java/org/sonar/java/externalreport/CheckstyleXmlReportReader.java:112-120 📄 external-reports/src/test/java/org/sonar/java/externalreport/CheckstyleSensorTest.java:145-153
The removed prefix check was also the only guard against an error element with a missing/empty source attribute (getAttributeValue returns "" in that case, and "".startsWith(CHECKSTYLE_PREFIX) was false, so the element was skipped with a debug log). Now such an element produces key = "" and ExternalIssueUtils.saveIssue is called with a blank ruleId, so either a meaningless issue with an empty rule key is reported or the platform rejects the blank rule id (RuleKey.of requires a non-blank rule) — and because CheckstyleSensor.importReport catches Exception around the whole parse, one such element aborts the import of every remaining file in the report (same failure mode already demonstrated by checkstyle-with-invalid-line.xml). Since this PR intentionally widens the reader to accept checkstyle-format XML produced by non-Checkstyle/custom tooling, a missing source is realistic input; restore an explicit empty-source guard (SpotBugsXmlReportReader does exactly this for an empty @type at SpotBugsXmlReportReader.java:146-149) and add a fixture covering it.

Implementation Status ✅ 2 of 2 objectives covered

✅ SONARJAVA-5397 - 2 of 2 objectives covered

This PR covers both objectives: reducing the Checkstyle rule key when the prefix is present, and importing issues even when they lack the prefix and rule description.

✅ 2 covered here

• ✅ Continue to reduce the rule key by removing the com.puppycrawl.tools.checkstyle.checks. prefix if possible
• ✅ Import Checkstyle issues even if the rule key does not start with the prefix and has no rule description

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
71.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[vdiez]

The implementation matches SONARJAVA-5397 and the linked customer report: it preserves the shortened IDs for built-in Checkstyle rules while allowing custom rule IDs through. I found no functional blocker.

Non-blocking suggestion: add regression coverage for an <error> with a missing or empty source. The guard added in dd442c5 is currently uncovered, even though the earlier review requested both the guard and a fixture. Placing such an element before a valid custom issue and asserting that import continues would protect this error-recovery behavior.

Validated locally with mvn -pl external-reports test -Dsonar.skip=true (30 tests passed); all PR checks are green.