sonarcloud-remediation

Fetch, group, and fix SonarCloud issues with validated pull request automation.

8|7|Updated Feb 14, 2023
One-click install
npx skills add https://github.com/eclipse-slm/slm --skill sonarcloud-remediation-eclipse-slm
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sonarcloud-remediation
Source: https://github.com/eclipse-slm/slm/tree/main/.agents/skills/sonarcloud-remediation
Command: npx skills add https://github.com/eclipse-slm/slm --skill sonarcloud-remediation-eclipse-slm

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Manually triaging thousands of SonarCloud issues across a codebase is slow and error-prone. This Skill automates the full remediation loop: fetching issues from the SonarCloud or SonarQube API, grouping them by rule and module, prioritizing by remediation impact, applying fixes, validating them, and creating focused pull requests with human approval checkpoints. ## Core Features & Use Cases - Prioritized Analysis (Phase A): Fetches all open issues, security hotspots, and duplication metrics, then groups them by rule key and module (with monorepo workspace and Ansible collection detection) into a numbered, priority-sorted report. - Guided Fixing (Phase B): Applies group-level fixes with approval gates, caps changes at ~200 LOC per PR, runs mandatory validation commands, and creates branches and PRs/MRs via the GitHub or GitLab CLI. - PR-Specific Mode: Filters analysis to a single pull request so teams can address new issues before merging. - Use Case: A maintainer runs the analysis on a repository with 800 maintainability issues, picks the low-risk unused-imports group, approves the proposed fixes, and gets a validated PR titled with the SonarCloud rule and module. ## Quick Start Ask the assistant to analyze SonarCloud issues for this project and fix the top low-risk group, providing your Sonar organization, project key, base branch, and validation commands when prompted.

Frequently Asked Questions about sonarcloud-remediation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix SonarCloud issues automatically?▼

Run the analyze phase to fetch and group all open issues by rule and module, then select a group for the fix phase. The skill proposes fixes, waits for your approval, runs your validation commands, and creates a pull request only after explicit confirmation.

How do I check SonarCloud issues for a specific pull request?▼

Set the SONAR_PR_NUMBER environment variable or mention the PR number when invoking the analysis. The fetch script passes the pullRequest parameter to the Sonar API so only issues introduced by that PR are returned.

Does this work with self-hosted SonarQube instead of SonarCloud?▼

Yes. Set SONAR_BASE_URL to your SonarQube instance API URL, and the organization parameter becomes optional. The same token authentication and fetch workflow apply to both platforms.

What environment variables are required for SonarCloud API access?▼

SONAR_PROJECT_KEY is always required, and SONAR_ORGANIZATION is required for SonarCloud. Private projects also need SONARCLOUD_TOKEN set in the environment before starting; the skill never prompts for the token directly.

Why does the SonarCloud fetch script return an authentication or not-found error?▼

HTTP 401 means the SONARCLOUD_TOKEN is invalid, HTTP 403 indicates insufficient permissions, and HTTP 404 means the project key is wrong. An HTTP 400 with a missing-organization hint means the Sonar instance requires SONAR_ORGANIZATION to be set.

How are large groups of SonarCloud fixes split into pull requests?▼

Changes are capped at roughly 200 lines of code per PR. Groups exceeding that limit are split into batches by file or logical grouping, each getting its own branch and pull request targeting the configured base branch.