SONARJAVA-6696: S8989 should not raise on private methods

[romainbrenguier]

Summary

• S8989 (@Transactional methods should specify rollback behavior for checked exceptions) now skips private methods
• Spring AOP uses proxies that cannot intercept private methods, so @Transactional has no effect on them — raising an issue would be a false positive
• Added test cases covering private methods at both method-level and class-level @Transactional

Test plan

• Existing unit tests pass (3/3)
• New compliant test cases for private methods with @Transactional
• New compliant test case for private method under class-level @Transactional
• Public methods in same class-level @Transactional still raise issues

🤖 Generated with Claude Code

[hashicorp-vault-sonar-prod]

SONARJAVA-6696

[gitar-bot]

Code Review ✅ Approved 2 resolved / 2 findings

Updates rule S8989 to skip non-public methods where Spring AOP proxies cannot intercept @Transactional, addressing the import ordering and scope coverage findings. Comprehensive test cases have been added to verify the fix.

✅ 2 resolved

✅ Quality: Import ordering broken by new ModifiersUtils import

📄 java-checks/src/main/java/org/sonar/java/checks/spring/TransactionalMethodCheckedExceptionCheck.java:27-28
org.sonar.java.model.ModifiersUtils is inserted before org.sonar.java.checks.helpers.SpringUtils, breaking the alphabetical import order the rest of the file follows. If the project enforces import ordering (checkstyle/spotless), this will fail the build. Move the ModifiersUtils import below the checks.helpers.* imports.

✅ Edge Case: Only private skipped; protected/package-private also not proxied

📄 java-checks/src/main/java/org/sonar/java/checks/spring/TransactionalMethodCheckedExceptionCheck.java:57-60
Spring's proxy-based AOP only applies @transactional to public methods; protected and package-private methods are also not intercepted, so the rule still raises false positives on them just like it did on private methods. If the intent is to avoid false positives on non-proxied methods, consider skipping any non-public method (e.g. also check for absence of PUBLIC), not just PRIVATE.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
95.2% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[romainbrenguier]

If it has not effect, why would one put the annotation? This case will be covered by S2230.