SONARJAVA-6489: Implement rule S8909 - Quarkus CacheKeyGenerator should be instantiable

[romainbrenguier]

Summary

Implements rule S8909 to detect Quarkus CacheKeyGenerator implementations that cannot be instantiated by the CDI container.

Changes

• Implemented CacheKeyGeneratorInstantiableCheck to detect classes implementing CacheKeyGenerator that:
  • Have no public no-args constructor AND
  • Are not CDI beans (missing scope annotations like @ApplicationScoped, @Dependent, etc.)
• Added comprehensive test coverage with both compliant and non-compliant cases
• Created mock-up CacheKeyGenerator interface for testing (avoiding external dependency)

Test Coverage

The rule detects:

• ✅ Classes with constructor dependencies but no CDI scope annotation
• ✅ Classes with multiple constructors (none no-args) and no CDI scope
• ✅ Classes with private constructors

The rule correctly ignores:

• ✅ Classes with CDI scope annotations (even with dependencies)
• ✅ Classes with public no-args constructors
• ✅ Abstract classes and interfaces
• ✅ Non-CacheKeyGenerator classes

🤖 Generated with Claude Code

[hashicorp-vault-sonar-prod]

SONARJAVA-6489

[gitar-bot]

Code Review ✅ Approved 3 resolved / 3 findings

Implements rule S8909 to detect non-instantiable Quarkus CacheKeyGenerator classes. The build metadata, dependency conflicts, and package-private constructor false positives have all been resolved.

✅ 3 resolved

✅ Quality: Missing S8909 rule metadata (HTML + JSON) breaks build

📄 java-checks/src/main/java/org/sonar/java/checks/quarkus/CacheKeyGeneratorInstantiableCheck.java:30
The new rule CacheKeyGeneratorInstantiableCheck is annotated with @Rule(key = "S8909") and is auto-registered via CheckListGenerator, but no metadata files exist for it. GeneratedCheckListTest asserts that both org/sonar/l10n/java/rules/java/S8909.html and S8909.json exist for every registered rule (see GeneratedCheckListTest.java:137-142), and a Glob confirms neither file is present. Without these the rule has no description, no severity/type/profile assignment, and the test suite (hence the build) will fail. Add S8909.html (rule description) and S8909.json (metadata: title, type, status, tags, remediation, default severity, and SonarWay profile membership) under java-checks/src/main/resources/org/sonar/l10n/java/rules/java/.

✅ Quality: Redundant quarkus-cache dependency conflicts with local mock interface

📄 java-checks-test-sources/default/pom.xml:189-194 📄 java-checks-test-sources/default/src/main/java/io/quarkus/cache/CacheKeyGenerator.java:8-9
The PR adds the real io.quarkus:quarkus-cache:3.2.0.Final dependency in pom.xml AND also adds a hand-written mock io/quarkus/cache/CacheKeyGenerator.java with the same fully-qualified name. The PR description states the mock was created "avoiding external dependency", which directly contradicts also adding the dependency. Having both a local source file and a jar that define io.quarkus.cache.CacheKeyGenerator on the same compile path is at best redundant and can cause type-resolution ambiguity / duplicate-type issues in the test-sources module. Pick one approach: either rely on the real dependency and delete the mock, or keep the mock and drop the new dependency from pom.xml (consistent with the stated intent). Note the real Quarkus CacheKeyGenerator also declares a default boolean generationGroup() method, so the mock is not a faithful copy.

✅ Edge Case: Implicit constructor of package-private class treated as public

📄 java-checks/src/main/java/org/sonar/java/checks/quarkus/CacheKeyGeneratorInstantiableCheck.java:86-98 📄 java-checks/src/main/java/org/sonar/java/checks/quarkus/CacheKeyGeneratorInstantiableCheck.java:49-51
hasPublicNoArgsConstructor returns true when the no-arg constructor's declaration() == null (implicit default constructor), regardless of visibility. An implicit default constructor inherits the class's access level, so for a package-private (or private nested) class implementing CacheKeyGenerator the implicit constructor is NOT public. The issue message explicitly tells users to add a "public no-args constructor", yet such a class is reported compliant — an inconsistency that can produce a false negative if Quarkus requires a public constructor for non-CDI instantiation. Consider also checking the effective visibility of the implicit constructor (e.g. require the class itself to be public), or align the message with the actual check. Also note records/enums implementing the interface are not covered since nodesToVisit() only registers Tree.Kind.CLASS.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
93.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube