SONARJAVA-5708 Implement rule S8924: Mockito core methods should be imported statically

[NoemieBenard]

---

Summary by Gitar

• New rule implementation:
  • Implemented MockitoStaticImportCheck (rule S8924) to enforce static imports for common Mockito methods.
• Check coverage:
  • Detects non-compliant usage of methods like mock, when, verify, spy, any, and eq when called via Mockito. qualifier.
• Testing:
  • Added MockitoStaticImportCheckTest and corresponding sample file MockitoStaticImportCheckSample.java to verify rule reporting.

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-5708

[rombirli]

LGTM, small improvement suggestion

[rombirli]

Optional : it would better to create method matchers like here

[rombirli]

this would become

MOCKITO_METHODS.matches(mit.methodSymbol())

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[gitar-bot]

Code Review ✅ Approved 3 resolved / 3 findings

Implements rule S8924 to enforce static imports for Mockito methods, resolving missing metadata files and redundant receiver-type checks. No issues remain.

✅ 3 resolved

✅ Bug: Missing rule metadata files S8924.json / S8924.html

📄 java-checks/src/main/java/org/sonar/java/checks/tests/MockitoStaticImportCheck.java:29
The new rule MockitoStaticImportCheck is annotated @Rule(key = "S8924"), but no metadata resources exist for it. Every other rule has a <key>.json and <key>.html under sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/ (e.g. S6068.json/S6068.html), and JavaRulesDefinition loads them via RuleMetadataLoader.addRulesByAnnotatedClass. A Glob for **/rules/java/S8924.* returns nothing.

Without these files the rule will not be registered with a name, description, type, severity, SQALE/remediation, or be includable in the Sonar_way profile, and JavaRulesDefinition/rule-metadata tests will fail to load the rule. Add S8924.json (with the appropriate Tests scope so it is picked up for the quality profile) and S8924.html description. This is expected for a draft PR, but is required before the rule can ship.

✅ Quality: Redundant receiver-type check after MethodMatchers migration

📄 java-checks/src/main/java/org/sonar/java/checks/tests/MockitoStaticImportCheck.java:34-38 📄 java-checks/src/main/java/org/sonar/java/checks/tests/MockitoStaticImportCheck.java:54
On line 54, MOCKITO_METHODS.matches(mit.methodSymbol()) already constrains matches to methods owned by org.mockito.Mockito (via .ofTypes(MOCKITO_CLASS) on line 35). The additional && mset.expression().symbolType().is(MOCKITO_CLASS) is now largely redundant — the method symbol resolution already guarantees the method belongs to the Mockito class. You can likely drop the second condition to simplify the check.

Note that the two conditions are not perfectly equivalent: matches(methodSymbol) keys off the resolved method owner, while symbolType().is(...) keys off the receiver expression's static type. If you want to keep behavior identical to the old name-only logic (report only when invoked through a Mockito-typed receiver), the extra check is intentional and can stay. Otherwise it can be removed for clarity.

✅ Quality: S8924 declares "quickfix":"targeted" but no quick fix is implemented

📄 sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S8924.json:18 📄 java-checks/src/main/java/org/sonar/java/checks/tests/MockitoStaticImportCheck.java:44-56
The rule metadata sets "quickfix": "targeted", which advertises to clients (e.g. SonarLint/IDEs) that an automatic fix is available. However, MockitoStaticImportCheck.visitNode only calls reportIssue(methodSelect, ...) and never registers a JavaQuickFix. Other rules using "targeted"/"covered" (e.g. UnusedLocalVariableCheck) attach a quick fix via reportIssue(...) with a list of JavaQuickFix objects. There is no consistency test, so this will not fail the build, but the rule promises a fix that is never delivered.

This rule is an ideal quick-fix candidate: the fix is mechanical (remove the Mockito. prefix and add the corresponding import static org.mockito.Mockito.<method>;). Either implement the quick fix and verify it with [[quickfixes=...]] annotations / QuickFixVerifier, or change the metadata to "quickfix": "infeasible" (or "partial") to match the current implementation.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}