[claire-villard-sonarsource]

Part of

---

Summary by Gitar

• Build packaging:
  • Moved sonar-packaging-maven-plugin below maven-shade-plugin in sonar-java-plugin/pom.xml
  • Added build-zip execution that runs the zip goal after shading
• Properties:
  • Set version.sonar-packaging.plugin to 2.1.0.3083
• Plugin configuration:
  • Wrapped plugin configuration in default-sonar-plugin execution
• New module:
  • Added sonar-java-plugin-zip module packaging the plugin JAR as a sonar-plugin-zip artifact
  • Registered sonar-java-plugin-zip in root pom.xml modules
• Documentation:
  • Moved documentation.md into sonar-java-plugin-zip/src/main/resources/

_{This will update automatically on new commits.}

[datadog-sonarsource]

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 3a3f839 | Docs | Give us feedback!}

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Adding a ZIP-packaging Maven module and pinning its packaging plugin changes build artifact assembly, which could produce incomplete or incompatible plugin distributions.

Build packaging change adds a build-zip execution after shading in sonar-java-plugin/pom.xml, adds a sonar-java-plugin-zip module, and sets version.sonar-packaging.plugin to 2.1.0.3078. No open issues found.

✅ 1 closed

Closed: Bug: Duplicate plugin declaration moves build-zip before shade

📄 sonar-java-plugin/pom.xml:162-176 📄 sonar-java-plugin/pom.xml:270-284
sonar-packaging-maven-plugin is now declared twice in <build><plugins>: once at line 162 (new, before maven-shade-plugin) and once at line 275 (after it). Maven 3 only warns about the duplicate ("must be unique but found duplicate declaration of plugin"). It then merges the two blocks in DefaultModelNormalizer.mergeDuplicates, which uses a LinkedHashMap. Re-putting a key that already exists in a LinkedHashMap keeps the key's original position, so the merged plugin, including the build-zip execution, ends up at the position of the first declaration, ahead of maven-shade-plugin. Both zip and shade bind to package and run in plugin order. The lifecycle-bound default-sonar-plugin still runs first because of its injected priority, but zip now runs before shade rewrites the jar, so the ZIP wraps the unshaded jar. The comment at lines 270-274 exists to prevent exactly this, and this commit undoes it. Fix: keep one plugin block after the shade plugin and put the default-sonar-plugin execution with its configuration next to build-zip.

Verification Rules 2/2 met Repos 5 inspected · PRs 1 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 5 inspected PRs 1 inspected

Cross-repo 5 repositories inspected 0 open impacts

SonarSource/sonar-packaging-maven-plugin Inspected
SonarSource/sonarlint-vscode Inspected
SonarSource/sonarlint-intellij Inspected
SonarSource/sonarlint-language-server Inspected
SonarSource/sonar-java-symbolic-execution Inspected

Cross-PR 1 PR inspected 0 open impacts

PR 106: PACKMP-65 Build the ZIP in a dedicated module depending on the plugin module Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube