build: remove SonarQube Cloud; enforce line + branch coverage via JaCoCo#56
Merged
Conversation
SonarQube's findings largely duplicated tooling we already run at build
time (Error Prone + JSpecify, Spotless, JaCoCo floors, mutation testing),
and its new-code gate fired on attribution noise — surfacing pre-existing,
idiomatic patterns as "new" issues and demanding suppressions that litter
the build. The one thing it added that we wanted — coverage tracked at line
and branch level — JaCoCo already does natively and offline.
- Remove the org.sonarqube plugin + sonar{} block, version-catalog entry,
the `sonar` CI job, and the SonarCloud README badges.
- Add a BRANCH coverage limit to every module's existing
jacocoTestCoverageVerification rule (previously LINE only). Branch floors
are set a few points below current measured coverage to lock in today's
level and fail on regression; line floors are unchanged.
- ADR 0018 records the decision and supersedes ADR 0017.
Verified: `clean test jacocoTestCoverageVerification` runs all 13 module
gates and passes; standalone spotlessCheck is green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the 13 duplicated per-module LINE+BRANCH gates with one baseline in pkauth.test-conventions (LINE >=0.70, BRANCH >=0.55), keyed off the java-library plugin so it gates every published library module but not the examples/* demos (which apply test-conventions only for the JaCoCo report). Modules keep an override only to raise a bar above the baseline: core/jwt/ admin-api hold the >=0.80 line bar (brief §11); jwt/backup-codes/otp/ refresh-tokens pin BRANCH near their current high coverage. Every other module rides the baseline. Net -132 lines. Verified: a clean `test jacocoTestCoverageVerification` passes all library gates; with the central BRANCH floor forced to 0.99, pk-auth-micronaut (no override) fails while examples:spring-boot-demo still passes — confirming the baseline gates libraries and not the demos. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Removes the SonarQube Cloud integration and replaces its one genuinely useful feature — line/branch coverage tracking — with native JaCoCo gates.
Why
SonarQube's value here was weak: its findings largely duplicate tooling already run at build time (Error Prone + JSpecify for null discipline, Spotless for formatting, per-module JaCoCo floors + Stryker mutation testing for test effectiveness). Worse, its new-code gate fired on attribution noise — e.g. editing one line of an existing file surfaced a pre-existing, idiomatic
HttpResponse<?>Micronaut controller return as a "new" issue and failed the gate. Keeping it green meant littering the build with rule suppressions. Full rationale in ADR 0018.Changes
Remove SonarQube:
org.sonarqubeplugin +sonar { }block, version-catalog entry, thesonarCI job, and the SonarCloud README badges. ADR 0017 marked Superseded; ADR 0018 added.Enforce coverage natively —
LINE+BRANCH, via a hybrid baseline + overrides:pkauth.test-conventions(LINE >=0.70, BRANCH >=0.55), keyed off thejava-libraryplugin so it gates every published library module but not theexamples/*demos (which applytest-conventionsonly for the JaCoCo report).Verification
./gradlew clean test jacocoTestCoverageVerificationruns all 13 library gates fresh and passes; standalonespotlessCheckis green.pk-auth-micronaut(no override) fails whileexamples:spring-boot-demostill passes — the baseline gates libraries, not the demos.(A flaky Spotless 8.x classloader error can appear when
clean+ fullcheckrun together — a known issue noted in CLAUDE.md, unrelated to this change.)🤖 Generated with Claude Code