[claire-villard-sonarsource]

Part of

---

Summary by Gitar

• Build packaging:
  • Moved sonar-packaging-maven-plugin below maven-shade-plugin in sonar-java-plugin/pom.xml
  • Added build-zip execution that runs the zip goal after shading
• Properties:
  • Added version.sonar-packaging.plugin property set to 2.1.0.3075
• Plugin configuration:
  • Wrapped plugin configuration in default-sonar-plugin execution

_{This will update automatically on new commits.}

[sonarqube-next]

Quality Gate failed

Failed conditions
1 New issue

See analysis details on SonarQube

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Adding a ZIP packaging execution after shading changes generated artifacts; misconfiguration could produce an incomplete or incorrect plugin ZIP.

Reworks the sonar-java-plugin packaging so build-zip runs the zip goal after shading, with the sonar-packaging plugin version pinned via a new property. No open issues found.

✅ 1 closed

Closed: Bug: Duplicate plugin declaration moves build-zip before shade

📄 sonar-java-plugin/pom.xml:162-176 📄 sonar-java-plugin/pom.xml:270-284
sonar-packaging-maven-plugin is now declared twice in <build><plugins>: once at line 162 (new, before maven-shade-plugin) and once at line 275 (after it). Maven 3 only warns about the duplicate ("must be unique but found duplicate declaration of plugin"). It then merges the two blocks in DefaultModelNormalizer.mergeDuplicates, which uses a LinkedHashMap. Re-putting a key that already exists in a LinkedHashMap keeps the key's original position, so the merged plugin, including the build-zip execution, ends up at the position of the first declaration, ahead of maven-shade-plugin. Both zip and shade bind to package and run in plugin order. The lifecycle-bound default-sonar-plugin still runs first because of its injected priority, but zip now runs before shade rewrites the jar, so the ZIP wraps the unshaded jar. The comment at lines 270-274 exists to prevent exactly this, and this commit undoes it. Fix: keep one plugin block after the shade plugin and put the default-sonar-plugin execution with its configuration next to build-zip.

Verification Rules 2/2 met Repos 5 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 5 inspected

Cross-repo 5 repositories inspected 0 open impacts

SonarSource/sonar-java-symbolic-execution Inspected
SonarSource/sonarlint-vscode Inspected
SonarSource/sonarlint-intellij Inspected
SonarSource/sonarlint-core Inspected
SonarSource/sonarlint-language-server Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}