SONARJAVA-6716: Fix FN in S8909 for classes with explicit constructors but no no-arg constructor

[romainbrenguier]

Summary

• Fixed false negative in CacheKeyGeneratorInstantiableCheck (S8909) where public classes implementing CacheKeyGenerator with explicit constructors but no no-arg constructor were not flagged
• The hasPublicNoArgsConstructor() method now correctly distinguishes between classes with no explicit constructors (implicit default constructor inherits class visibility) and classes with explicit constructors that lack a no-arg option
• Added test case for a class with an explicit parameterized constructor but no no-arg constructor

Test plan

• Existing tests pass (CacheKeyGeneratorInstantiableCheckTest)
• New noncompliant test case added for the FN scenario
• CI pipeline passes

🤖 Generated with Claude Code

---

Summary by Gitar

• New features:
  • Added verifyAnalysisSucceeds() method to CheckVerifier to test analysis execution without assertions
• Refactoring:
  • Removed the obsolete autoscan integration test module and associated test files

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-6716

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Fixes a false negative in rule S8909 for public classes implementing CacheKeyGenerator with explicit constructors by updating no-arg constructor validation. The duplicate verifyAnalysisSucceeds setup logic was also addressed.

✅ 1 resolved

✅ Quality: verifyAnalysisSucceeds duplicates verifyAll setup logic

📄 java-checks-testkit/src/main/java/org/sonar/java/checks/verifier/internal/InternalCheckVerifier.java:287-301 📄 java-checks-testkit/src/main/java/org/sonar/java/checks/verifier/internal/InternalCheckVerifier.java:317-331
InternalCheckVerifier.verifyAnalysisSucceeds() re-implements almost the entire visitor/bridge/scanner setup already present in verifyAll() (sonarComponents, VisitorsBridgeForTests.Builder, semantic-vs-no-semantic branching, cache/scanWithoutParsing handling). This duplication means future changes to the analysis setup must be kept in sync across two methods and risks drift. Consider extracting the shared bridge/scanner construction into a private helper used by both verifyAll() and verifyAnalysisSucceeds().

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
60.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube