SONARJAVA-6711 USER-2405 Fix S3252 false positive for Quarkus Panache entity static methods

[romainbrenguier]

Panache uses bytecode generation to create static method implementations in entity subclasses, so accessing them via the derived type is the intended usage pattern. Skip the issue when the static member's owner is a Panache entity base class.

Part of

[hashicorp-vault-sonar-prod]

SONARJAVA-6711

[gitar-bot]

Code Review 👍 Approved with suggestions 0 resolved / 1 findings

Fixes S3252 false positives for Quarkus Panache entity static methods by skipping checks on Panache entity base classes. Consider narrowing the isPanacheEntityBase scope so it doesn't suppress warnings for user-defined static members.

💡 Quality: Panache suppression broader than bytecode-generated methods

_{Reply with Gitar … to ask about this finding.}

isPanacheEntityBase(staticType) suppresses S3252 for any static member whose declaring type is a Panache entity base subtype — not only the framework-generated methods (listAll/count/etc.). A user-declared static method inherited from a Panache-derived class and accessed via a further subclass would also be silently skipped, introducing a false negative. This is acceptable for the fix but consider narrowing to the known Panache base classes themselves (e.g. checking the exact owner FQN) if tighter scoping is desired.

🤖 Prompt for agents

Code Review: Fixes S3252 false positives for Quarkus Panache entity static methods by skipping checks on Panache entity base classes. Consider narrowing the isPanacheEntityBase scope so it doesn't suppress warnings for user-defined static members.

1. 💡 Quality: Panache suppression broader than bytecode-generated methods

   isPanacheEntityBase(staticType) suppresses S3252 for any static member whose declaring type is a Panache entity base subtype — not only the framework-generated methods (listAll/count/etc.). A user-declared static method inherited from a Panache-derived class and accessed via a further subclass would also be silently skipped, introducing a false negative. This is acceptable for the fix but consider narrowing to the known Panache base classes themselves (e.g. checking the exact owner FQN) if tighter scoping is desired.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube