sonar-autofix 0.0.5

package/packages/core/index.js

@@ -0,0 +1,473 @@
+// Core orchestrator for Sonar Autofix
+// Implements the complete workflow: Sonar → Fetch → Prioritize → Group → Fix → Validate → Repeat → Commit → Push → PR
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// Priority and type ordering as specified in PROJECT.md
+const SEVERITY_ORDER = { BLOCKER: 0, CRITICAL: 1, MAJOR: 2, MINOR: 3, INFO: 4 };
+const TYPE_ORDER = { BUG: 0, VULNERABILITY: 1, SECURITY_HOTSPOT: 2, CODE_SMELL: 3 };
+
+const DEFAULT_RETRY_LIMIT = 3;
+const DEFAULT_MAX_ITERATIONS = 5;
+
+class CoreOrchestrator {
+  /**
+   * @param {object} config - Full configuration object
+   * @param {object} [deps] - Dependency injection for clients
+   * @param {object} [deps.sonarClient]
+   * @param {object} [deps.llmClient]
+   * @param {object} [deps.gitClient]
+   * @param {object} [deps.validator]
+   */
+  constructor(config, deps = {}) {
+    this.config = config;
+    this.dryRun = config.dryRun || false;
+    this.retryLimit = config.retry?.maxRetries || DEFAULT_RETRY_LIMIT;
+    this.maxIterations = config.retry?.maxIterations || DEFAULT_MAX_ITERATIONS;
+    this.cwd = config.cwd || process.cwd();
+
+    // Dependency injection — lazily initialize if not provided
+    this._sonarClient = deps.sonarClient || null;
+    this._llmClient = deps.llmClient || null;
+    this._gitClient = deps.gitClient || null;
+    this._validator = deps.validator || null;
+
+    // Plugin hooks
+    this.hooks = {
+      beforeRun: config.hooks?.beforeRun || [],
+      beforeFile: config.hooks?.beforeFile || [],
+      afterFile: config.hooks?.afterFile || [],
+      afterRun: config.hooks?.afterRun || [],
+    };
+
+    // Load prompt template
+    this.promptTemplate = null;
+    this.retryPromptTemplate = null;
+  }
+
+  // Lazy client initialization
+  get sonarClient() {
+    if (!this._sonarClient) {
+      const SonarClient = require('@sonar-autofix/sonar-client');
+      this._sonarClient = new SonarClient(this.config);
+    }
+    return this._sonarClient;
+  }
+
+  get llmClient() {
+    if (!this._llmClient) {
+      const LLMClient = require('@sonar-autofix/llm-client');
+      this._llmClient = new LLMClient(this.config);
+    }
+    return this._llmClient;
+  }
+
+  get gitClient() {
+    if (!this._gitClient) {
+      const GitClient = require('@sonar-autofix/git-client');
+      this._gitClient = new GitClient(this.config, this.cwd);
+    }
+    return this._gitClient;
+  }
+
+  get validator() {
+    if (!this._validator) {
+      // const Validator = require('@sonar-autofix/validator');
+      // this._validator = new Validator(this.config, this.cwd);
+    }
+    return this._validator;
+  }
+
+  /**
+   * Main orchestration — runs the complete workflow
+   */
+  async run() {
+    console.log('✓ Starting Sonar Autofix workflow...');
+
+    await this.runHooks('beforeRun');
+
+    try {
+      // Step 1: Create a working branch
+      const branchName = this.config.git?.branch || 'sonar-autofix';
+      if (!this.dryRun) {
+        await this.gitClient.createBranch(branchName);
+        console.log(`✓ Created branch: ${branchName}`);
+      }
+
+      let iteration = 0;
+      let totalFixed = 0;
+
+      while (iteration < this.maxIterations) {
+        iteration++;
+        console.log(`\n--- Iteration ${iteration}/${this.maxIterations} ---`);
+
+        // Step 2: Run Sonar analysis
+        console.log('✓ Running Sonar analysis...');
+        if (!this.dryRun) {
+          await this.sonarClient.runAnalysis(this.config.sonar?.project);
+        }
+
+        // Step 3: Fetch issues
+        console.log('✓ Fetching issues from Sonar...');
+        const issues = await this.fetchAndNormalizeIssues();
+        console.log(`✓ ${issues.length} issues found`);
+
+        if (issues.length === 0) {
+          console.log('✓ No issues remaining — workflow complete');
+          break;
+        }
+
+        // Step 4: Prioritize
+        const prioritized = this.prioritizeIssues(issues);
+
+        // Step 5: Group by file
+        const grouped = this.groupByFile(prioritized);
+        console.log(`✓ Grouped into ${Object.keys(grouped).length} files`);
+
+        // Step 6: Fix files
+        let fixedInIteration = 0;
+        for (const [filePath, fileIssues] of Object.entries(grouped)) {
+          await this.runHooks('beforeFile', { filePath, issues: fileIssues });
+
+          console.log(`✓ Fixing ${filePath} (${fileIssues.length} issues)...`);
+          console.log(issues[0]);
+          const result = await this.fixFileWithRetry(filePath, fileIssues);
+
+          if (result.success) {
+            fixedInIteration++;
+            console.log(`  ✓ ${filePath} fixed successfully`);
+          } else {
+            console.log(`  ✗ ${filePath} could not be fixed — restoring original`);
+            if (!this.dryRun) {
+              await this.gitClient.restoreFile(filePath);
+            }
+          }
+
+          await this.runHooks('afterFile', { filePath, issues: fileIssues, result });
+        }
+
+        totalFixed += fixedInIteration;
+
+        if (fixedInIteration === 0) {
+          console.log('✓ No files fixed in this iteration — stopping');
+          break;
+        }
+
+        //TODO
+        // Step 7: Validate the batch
+        // console.log('✓ Running batch validation...');
+        // const batchResult = await this.validator.validateBatch();
+        // if (!batchResult.success) {
+        //   console.log('✗ Batch validation failed — restoring all changes');
+        //   if (!this.dryRun) {
+        //     await this.gitClient.reset('hard');
+        //   }
+        //   break;
+        // }
+        // console.log('✓ Batch validation passed');
+      }
+
+      // Step 8: Commit and push
+      if (totalFixed > 0 && !this.dryRun) {
+        const hasChanges = await this.gitClient.hasChanges();
+        if (hasChanges) {
+          console.log('✓ Committing changes...');
+          await this.gitClient.commit();
+
+          console.log('✓ Pushing branch...');
+          await this.gitClient.push(branchName);
+
+          // Step 9: Create PR
+          console.log('✓ Creating Pull Request...');
+          const prUrl = await this.gitClient.createPullRequest(
+            'fix(sonar): automatically resolve Sonar issues',
+            this.buildPRBody(totalFixed, iteration),
+          );
+          console.log(`✓ Pull Request created: ${prUrl}`);
+        }
+      } else if (this.dryRun) {
+        console.log('✓ Dry-run mode — skipping commit/push/PR');
+      } else {
+        console.log('✓ No changes to commit');
+      }
+
+      const summary = { totalFixed, iterations: iteration };
+      await this.runHooks('afterRun', summary);
+
+      console.log(`\n✓ Workflow complete — ${totalFixed} files fixed in ${iteration} iteration(s)`);
+      return summary;
+    } catch (error) {
+      console.error('✗ Workflow failed:', error.message);
+      throw error;
+    }
+  }
+
+  /**
+   * Fetch issues from Sonar and normalize them into a consistent format
+   */
+  async fetchAndNormalizeIssues() {
+    const projectKey = this.config.sonar?.project;
+    const response = await this.sonarClient.getIssues(projectKey);
+
+    // Sonar API returns { issues: [...], ... }
+    const rawIssues = response.issues || response || [];
+
+    return rawIssues.map(issue => ({
+      key: issue.key,
+      rule: issue.rule,
+      severity: issue.severity || 'MAJOR',
+      type: issue.type || 'CODE_SMELL',
+      message: issue.message,
+      component: issue.component,
+      file: this.extractFilePath(issue.component, projectKey),
+      line: issue.line || (issue.textRange && issue.textRange.startLine) || 0,
+      effort: issue.effort,
+      status: issue.status,
+    }));
+  }
+
+  /**
+   * Extract the relative file path from a Sonar component key
+   * Component keys look like: "project-key:src/main/File.ts"
+   */
+  extractFilePath(component, projectKey) {
+    if (!component) return '';
+    const prefix = projectKey + ':';
+    if (component.startsWith(prefix)) {
+      return component.substring(prefix.length);
+    }
+    return component;
+  }
+
+  /**
+   * Prioritize issues per PROJECT.md ordering:
+   * 1. By severity: BLOCKER > CRITICAL > MAJOR > MINOR > INFO
+   * 2. By type: Bug > Vulnerability > Security Hotspot > Code Smell
+   */
+  prioritizeIssues(issues) {
+    return [...issues].sort((a, b) => {
+      const sevA = SEVERITY_ORDER[a.severity] ?? 99;
+      const sevB = SEVERITY_ORDER[b.severity] ?? 99;
+      if (sevA !== sevB) return sevA - sevB;
+
+      const typeA = TYPE_ORDER[a.type] ?? 99;
+      const typeB = TYPE_ORDER[b.type] ?? 99;
+      return typeA - typeB;
+    });
+  }
+
+  /**
+   * Group issues by file path — one LLM call per file, not per issue
+   */
+  groupByFile(issues) {
+    const grouped = {};
+    for (const issue of issues) {
+      const file = issue.file;
+      if (!file) continue;
+      if (!grouped[file]) grouped[file] = [];
+      grouped[file].push(issue);
+    }
+    return grouped;
+  }
+
+  /**
+   * Fix a file with retry logic
+   * On failure: retry up to retryLimit times, then restore original
+   */
+  async fixFileWithRetry(filePath, issues) {
+    const absPath = path.resolve(this.cwd, filePath);
+
+    // Read original file content
+    let originalContent;
+    try {
+      originalContent = fs.readFileSync(absPath, 'utf8');
+    } catch (err) {
+      console.log(`  ✗ Cannot read file: ${err.message}`);
+      return { success: false, error: err.message };
+    }
+
+    let currentContent = originalContent;
+    let lastErrors = '';
+
+    for (let attempt = 1; attempt <= this.retryLimit; attempt++) {
+      if (attempt > 1) {
+        console.log(`  ↻ Retry attempt ${attempt}/${this.retryLimit}...`);
+      }
+
+      try {
+        // Build prompt and call LLM
+        const fixedContent = await this.requestFix(filePath, currentContent, issues, lastErrors, attempt);
+
+        if (!fixedContent || fixedContent.trim() === currentContent.trim()) {
+          console.log('  ✗ LLM returned unchanged content');
+          return { success: false, error: 'No changes produced' };
+        }
+
+        // Write the fixed content
+        if (!this.dryRun) {
+          fs.writeFileSync(absPath, fixedContent, 'utf8');
+        }
+
+        // Validate the file
+        // const validation = await this.validator.validateFile(filePath);
+        // if (validation.success) {
+          return { success: true, attempt };
+        // }
+
+        // Validation failed — prepare for retry
+        // lastErrors = validation.errors.join('\n');
+        // currentContent = fixedContent;
+        // console.log(`  ✗ Validation failed: ${validation.errors[0]}`);
+      } catch (err) {
+        console.log(`  ✗ Fix attempt failed: ${err.message}`);
+        lastErrors = err.message;
+      }
+    }
+
+    // All retries exhausted — restore original
+    if (!this.dryRun) {
+      fs.writeFileSync(absPath, originalContent, 'utf8');
+    }
+    return { success: false, error: 'All retry attempts exhausted' };
+  }
+
+  /**
+   * Request a fix from the LLM
+   */
+  async requestFix(filePath, fileContent, issues, validationErrors, attempt) {
+    // Truncate file content if too long
+
+    const issueDescriptions = issues.map((issue, i) =>
+      `Issue ${i + 1}:\n- Rule: ${issue.rule}\n- Severity: ${issue.severity}\n- Type: ${issue.type}\n- Message: ${issue.message}\n- Line: ${issue.line}`
+    ).join('\n\n');
+
+    let systemPrompt = 'You are an expert software engineer tasked with fixing code quality issues identified by SonarQube/SonarCloud.';
+
+    let userPrompt;
+    if (attempt > 1 && validationErrors) {
+      // Retry prompt
+      userPrompt = `A previous attempt to fix this file failed validation. Please fix the file again, addressing both the original Sonar issues AND the validation errors.
+
+File: ${filePath}
+
+\`\`\`
+${fileContent}
+\`\`\`
+
+Original Sonar Issues:
+${issueDescriptions}
+
+Validation Errors from Previous Attempt:
+\`\`\`
+${validationErrors}
+\`\`\`
+
+Rules:
+- Modify only the supplied file.
+- Do not rename public APIs.
+- Preserve formatting and code style.
+- Do not introduce unrelated changes.
+- Return the complete file content.
+
+Return ONLY the complete fixed file content, wrapped in a code block.`;
+    } else {
+      // First attempt prompt
+      userPrompt = `Fix the following Sonar issues in this file.
+
+File: ${filePath}
+
+\`\`\`
+${fileContent}
+\`\`\`
+
+Issues to Fix:
+${issueDescriptions}
+
+${this.config.prompt?.codingGuidelines ? `Coding Guidelines:\n${this.config.prompt.codingGuidelines}\n` : ''}
+${this.config.prompt?.projectInstructions ? `Project Instructions:\n${this.config.prompt.projectInstructions}\n` : ''}
+
+Rules:
+- Modify only the supplied file.
+- Do not rename public APIs.
+- Preserve formatting and code style.
+- Do not introduce unrelated changes.
+- Return the complete file content.
+
+Return ONLY the complete fixed file content, wrapped in a code block.`;
+    }
+
+    const messages = [
+      { role: 'system', content: systemPrompt },
+      { role: 'user', content: userPrompt },
+    ];
+
+    const response = await this.llmClient.chat(messages, {
+      temperature: 0.1
+    });
+
+    // Extract code from the response (strip markdown code block markers)
+    return this.extractCodeFromResponse(response);
+  }
+
+  /**
+   * Extract code content from LLM response, stripping markdown fences
+   */
+  extractCodeFromResponse(response) {
+    if (!response) {
+      console.log('No response from LLM');
+      return null;
+    }
+
+    // Try to extract from code block
+    const codeBlockMatch = response.match(/```[\w]*\n([\s\S]*?)```/);
+    if (codeBlockMatch) {
+      return codeBlockMatch[1];
+    }
+
+    // If no code block found, return the response as-is (it might be raw code)
+    return response.trim();
+  }
+
+  /**
+   * Build a descriptive PR body
+   */
+  buildPRBody(totalFixed, iterations) {
+    return `## Automated Sonar Issue Fixes
+
+This PR was automatically generated by **sonar-autofix**.
+
+### Summary
+- **Files fixed:** ${totalFixed}
+- **Iterations:** ${iterations}
+
+### What was done
+1. Ran SonarQube/SonarCloud analysis
+2. Fetched and prioritized open issues
+3. Used LLM to generate fixes grouped by file
+4. Validated each fix (syntax, lint, build)
+5. Re-ran Sonar to verify improvement
+6. Committed all successful fixes
+
+### Review Notes
+- All changes have been validated against the project's build, lint, and test configuration.
+- Please review the changes carefully before merging.
+
+---
+*Generated by [sonar-autofix](https://github.com/sonar-autofix)*`;
+  }
+
+  /**
+   * Run plugin hooks
+   */
+  async runHooks(hookName, context = {}) {
+    const hooks = this.hooks[hookName] || [];
+    for (const hook of hooks) {
+      if (typeof hook === 'function') {
+        await hook(context);
+      }
+    }
+  }
+}
+
+module.exports = CoreOrchestrator;

package/packages/core/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@sonar-autofix/core",
+  "version": "0.0.1",
+  "description": "Core orchestrator for the Sonar Autofix tool",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [
+    "sonar",
+    "autofix",
+    "github",
+    "action"
+  ],
+  "author": "Sonar Autofix Team",
+  "license": "MIT",
+  "dependencies": {
+    "@sonar-autofix/sonar-client": "^0.0.1",
+    "@sonar-autofix/llm-client": "^0.0.1",
+    "@sonar-autofix/git-client": "^0.0.1"
+  }
+}