RC-451 Migrate Java ruling expectations to SARIF

.agents/skills/new-rule/SKILL.md

@@ -85,7 +85,7 @@ If **ruling** fails (likely for a new rule), a PR updating the expectations is c
 
 ### Step 6 — TP/FP analysis (only when Step 5 is fully green)
 
-1. Collect the **new** findings from the ruling expectation diff: `its/ruling/src/test/resources/expected/<project>/java-<RULE_ID>.json`, where each entry is `"group:artifact:path/to/File.java": [line, …]`. Sources are under `its/sources/<project>/`.
+1. Collect the **new** findings from the ruling expectation diff, i.e. the `runs[].results[]` entries added to `its/ruling/src/test/resources/expected/<project>/java-<RULE_ID>.sarif` by the merged ruling-update commit (e.g. `git diff origin/master -- its/ruling/src/test/resources/expected/`). Its `locations[0].physicalLocation.artifactLocation.uri` is `<projectKey>:path/to/File.java` and `locations[0].physicalLocation.region` gives the line and column. Sources are under `its/sources/<expected-dir-name>/`.
 2. **Sample** new findings before classifying (do not analyze unbounded volumes):
    - Let `N` be the sample size (default **100**).
    - If total new findings ≤ `N` → analyze **all**.

.github/actions/upload-actual/action.yml

@@ -38,11 +38,12 @@ runs:
         EXPECTED_DIR: ${{ inputs.expected-dir }}
         ACTUAL_DIR: ${{ inputs.actual-dir }}
         NAME: ${{ inputs.name }}
+        NODE_OPTIONS: --max-old-space-size=8192
       run: |
         cd "${IT_DIR}"
-        mkdir -p target
-        diff --unified --recursive --strip-trailing-cr "${EXPECTED_DIR}" "${ACTUAL_DIR}" > "target/test.diff" || true
-        npx diff2html-cli --input file --style side --file "target/diff_${NAME}.html" -- "target/test.diff"
+        mkdir -p target "${EXPECTED_DIR}"
+        diff --unified --recursive --new-file --exclude=.gitkeep --strip-trailing-cr "${EXPECTED_DIR}" "${ACTUAL_DIR}" > "target/test.diff" || true
+        npx diff2html-cli --input file --style side --diffMaxChanges 2000 --file "target/diff_${NAME}.html" -- "target/test.diff"
 
     - name: Upload Diff Report
       if: runner.os != 'Windows'

.github/workflows/ruling-diff-comment.yml

@@ -4,8 +4,7 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
-      # Trigger on ruling JSON file changes
-      - 'its/ruling/src/test/resources/**/*.json'
+      - 'its/ruling/src/test/resources/expected/**/*.sarif'
       # Uncomment to test action changes
       - '.github/workflows/ruling-diff-comment.yml'
   workflow_dispatch:
@@ -45,15 +44,13 @@ jobs:
         with:
           enable-cache: true
 
-      # Use the action from the branch we just pushed
       - name: Post ruling diff comment
         uses: SonarSource/core-languages-tooling-public/ruling-diff-comment@master
         with:
           pr-number: ${{ inputs.pr-number || github.event.pull_request.number }}
           repository: ${{ github.repository }}
           base-sha: ${{ inputs.base-sha || github.event.pull_request.base.sha }}
           head-sha: ${{ inputs.head-sha || github.event.pull_request.head.sha }}
-          ruling-root: 'its/ruling/src/test/resources/expected'
           sources-root: 'its/sources'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -139,7 +139,7 @@ Note for internal contributors: in order to also execute the tests that depend o
 
 #### Ruling Test
 
-The "Ruling Test" is an integration test suite that launches the analysis of a large code base, saves the issues created by the plugin in report files, and then compares those results to the set of expected issues (stored as JSON files).
+The "Ruling Test" is an integration test suite that launches the analysis of a large code base, saves the issues created by the plugin in SARIF reports, and then compares those results to the expected SARIF reports.
 
 To run the test, first make sure the submodules are checked out:
 
@@ -164,23 +164,23 @@ To run the ruling tests for only a subset of rules, use the `sonarRules` propert
 
 This test gives you the opportunity to examine the issues created by each rule and make sure they're what you expect. Any implemented rule is highly likely to raise issues on the multiple projects we use as ruling code base.
 
-* For a newly implemented rule, it means that a first build will most probably fail, caused by differences between expected results (without any values for the new rule) and the new results. You can inspect these new issues by searching for files named after your rule (`squid-SXXXX.json`) in the following folder:
+* For a newly implemented rule, the first build will most probably fail because no expected results exist for the new rule. Inspect the new issues in `java-SXXXX.sarif` for each project under:
 
         /path/to/project/sonar-java/its/ruling/target/actual/...
 
 * For existing rules which are modified, you may expect some differences between "actual" (from new analysis) and expected results. Review carefully the changes that are shown and update the expected resources accordingly.
 
-All the `json` files contain a list of lines, indexed by file, explaining where the issues raised by a specific rule are located. If/When everything looks good to you, you can copy the file with the actual issues located at:
+Each SARIF report contains a `runs[].results[]` entry for each issue, with its rule ID, message, and location. After reviewing the differences, copy the relevant actual report from:
 
     its/ruling/target/actual/
 
 Into the directory with the expected issues:
 
     its/ruling/src/test/resources/expected/
 
-For example using the command:
+For example, from the repository root, to update one rule in one project:
 
-    cp its/ruling/target/actual/* its/ruling/src/test/resources/expected/
+    cp its/ruling/target/actual/<project>/java-SXXXX.sarif its/ruling/src/test/resources/expected/<project>/
 
 #### Debugging Integration Tests
 You can debug ITs by adding `-Dmaven.binary=mvnDebug` as an option when running the tests. This will cause the analyzer JVM to wait for a debugger to be attached before continuing.

its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java

@@ -108,7 +108,7 @@ private static OrchestratorRule createOrchestrator() {
       .useDefaultAdminCredentialsForBuilds(true)
       .setSonarVersion(System.getProperty("sonar.runtimeVersion", "LATEST_RELEASE"))
       .addPlugin(FileLocation.of(TestClasspathUtils.findModuleJarPath("../../sonar-java-plugin").toFile()))
-      .addPlugin(MavenLocation.of("org.sonarsource.sonar-lits-plugin", "sonar-lits-plugin", "0.11.0.2659"));
+      .addPlugin(MavenLocation.of("org.sonarsource.sonar-lits-plugin", "sonar-lits-plugin", "0.13.0.16223"));
 
     if (isCommunityEditionTestsOnly()) {
       orchestratorBuilder.setEdition(Edition.COMMUNITY);
@@ -182,9 +182,9 @@ private static void copyDumpSubset(Path srcProjectDir, Path dstProjectDir) {
       throw new IllegalStateException("Unable to create directory: " + dstProjectDir.toString());
     }
     SUBSET_OF_ENABLED_RULES.stream()
-      .map(ruleKey -> srcProjectDir.resolve("java-" + ruleKey + ".json"))
+      .map(ruleKey -> srcProjectDir.resolve("java-" + ruleKey + ".sarif"))
       .filter(p -> p.toFile().exists())
-      .forEach(srcJsonFile -> copyFile(srcJsonFile, dstProjectDir));
+      .forEach(srcSarifFile -> copyFile(srcSarifFile, dstProjectDir));
   }
 
   private static void copyFile(Path source, Path targetDir) {

its/ruling/src/test/resources/expected/.gitkeep

@@ -0,0 +1 @@
+