feat: migrate to SonarQube 2026.1 LTA (#8)

* build: bump sonarlint-analysis-engine 10.24 -> 11.3 + LTA 2026.1 analyzers

Build does NOT compile after this commit — engine 11.x removed
org.sonarsource.sonarlint.core.analysis.api.ActiveRule and changed
two other signatures. Phase 3 of the LTA migration plan adds the
adapter classes; Phase 4 wires them in. This commit is the version
checkpoint, intentionally pre-adapter.

* feat(daemon): add SimpleActiveRule adapter for engine 11.x ActiveRule SPI

* feat(hostplugin): NoOpAnalysisWarnings bean for engine 11.x sensors

Engine 11.3 ships zero references to org.sonar.api.notifications.AnalysisWarnings
but the bundled HTML/Java/Python/PHP sensors Spring-autowire it. This is the
host-side implementation that lives in the sonar-predictor-host plugin JAR
(added in Task 10).

Also adds logback-classic 1.5.13 and assertj-core 3.27.7 as test-scope deps
required by the ListAppender-based log-capture test.

* feat(hostplugin): SonarPredictHostPlugin registers NoOpAnalysisWarnings

* fix(daemon): adapt PluginRuntime to engine 11.x SonarLanguage API

- language.getPluginKey() -> language.getPlugin().getKey() (11.x rename)
- pass Set.of("sonarpredict-host") to PluginsLoader.load() as the
  additionalAllowedPlugins arg, so our host plugin is admitted into
  the analysis container's extension scan (belt-and-suspenders; the
  isNotSensor disjunct alone is also sufficient — see spec §4.1)

* fix(daemon): switch AnalysisService to public ActiveRule SPI

Engine 11.x removed org.sonarsource.sonarlint.core.analysis.api.ActiveRule
(the 10.x internal class). The public org.sonar.api.batch.rule.ActiveRule
is the replacement; SimpleActiveRule.of(...) builds instances of the
public interface in one call.

* fix(daemon): IssueMapper handles RuleKey return type from engine 11.x

engine.Issue.getRuleKey() returns org.sonar.api.rule.RuleKey in 11.x
(was String in 10.x). Add .toString() at the IssueMapper call site that
feeds the protocol's String ruleKey field. This is the third and final
adapter required to make the project compile on the LTA 2026.1 toolchain.

Also fix AnalysisServiceTest: SonarLanguage.getPluginKey() removed in
11.x; replaced with getPlugin().getKey() via the new SonarPlugin type.

* build: emit sonar-predictor-host plugin JAR as classifier=host

Second maven-jar-plugin execution scoped to the hostplugin package
produces target/sonar-predictor-<v>-host.jar in prepare-package.
Manifest declares Plugin-Class/Plugin-Key/Sonar-Version so the
sonarlint plugin loader treats it identically to a SonarSource
analyzer plugin.

* test(hostplugin): pin host JAR manifest contract

* build(dist): ship sonar-predictor-host JAR in the offline plugin bundle

* docs(pom): document LTA 2026.1 pinning + upgrade procedure

* test(hostplugin): verify host JAR loads and AnalysisWarnings bean wires

* fix(hostplugin): correct lifespan + loader semantics so the host bean wires

Three corrections surfaced by the full 335-test gate (Task 14 of the LTA
2026.1 migration plan); none was caught by the spec's javap analysis:

1. PluginRuntime.loadFrom — second arg to PluginsLoader.load is
   disabledPluginsForAnalysis, not additionalAllowedPlugins as the spec
   assumed. Passing "sonarpredict-host" actively EXCLUDED our host plugin
   from every Spring analysis container, leaving AnalysisWarnings unwired
   and reproducing the original "wall". Reverted to Set.of().

2. NoOpAnalysisWarnings @SonarLintSide(lifespan = INSTANCE -> SINGLE_ANALYSIS).
   The per-analysis AnalysisContainer calls install(ContainerLifespan.ANALYSIS),
   which matches the SINGLE_ANALYSIS string constant — not INSTANCE.
   HtmlSensor, the sensor that triggered the original NoSuchBeanDefinitionException,
   lives in this same container.

3. host-plugin-jar maven execution moved from prepare-package to
   process-test-classes, plus a maven-antrun copy-host-plugin-for-tests
   step that seeds the dev plugins/ dir with the host JAR. Required so the
   surefire-time daemon tests (which use AnalysisService's no-arg ctor =
   plugins/) can find the host plugin without a full assembly run.

HostPluginIntegrationTest refactored to use @tempdir + hardlink-or-copy
the vendored analyzer JARs plus the host JAR, filtering out *-host.jar
from the vendored glob to avoid a duplicate FileAlreadyExistsException
when antrun has already populated plugins/.

After these three corrections, full mvn verify reports 335/335 tests
passing, JaCoCo report intact, and the unpacked dist bundle analyzes a
Java fixture cleanly with zero NoSuchBeanDefinitionException occurrences.

* build: require Java 21 (sonarlint-analysis-engine 11.x ships major-65 class files)

LTA 2026.1's sonarlint-analysis-engine is compiled for Java 21. A javac
on JDK 17 cannot read its class files and bails out with:

  cannot access org.sonarsource.sonarlint.core.analysis.AnalysisScheduler
    bad class file: .../sonarlint-analysis-engine-11.3.0.85510.jar(...)
    class file has wrong version 65.0, should be 61.0

The local 335-test gate masked this because the dev machine was on JDK
25. CI on JDK 17 surfaced it on the first push.

Changes:
- pom.xml: maven.compiler.release/source/target 17 -> 21, with comment
  documenting the LTA-imposed minimum.
- .github/workflows/{ci,parity,publish,sonar}.yml: setup-java java-version
  '17' -> '21' (all four pipelines).
- src/main/staging/bin/sonar: MIN_MAJOR 17 -> 21, renamed is_java_17_plus
  -> is_java_min_plus, updated user-facing messages.
- src/main/staging/bin/sonar.bat: matched changes (GEQ 17 -> GEQ 21,
  messages).
- README.md: prerequisites table 'Java 17+' -> 'Java 21+'.

* build(test): drop ch.qos.logback dep — Socket flagged it obfuscatedFile (3 HIGH)

Socket Security raised three HIGH-severity obfuscatedFile alerts against
ch.qos.logback:{logback-classic,logback-core}:1.5.13 on PR #8. Logback's
optimized class files trip Socket's static-analysis pattern detector;
it's almost certainly a false positive against a widely-trusted library,
but the right answer is to not depend on it from a project that has no
need for a concrete SLF4J binding.

The dep was added by Task 5 (NoOpAnalysisWarnings TDD) solely so the
unit test could capture log output via logback's ListAppender. Two test
sites used logback APIs; both refactored to stay on slf4j-api only:

- NoOpAnalysisWarnings gains a package-private mutable `log` field that
  defaults to the static slf4j Logger but can be replaced by tests with
  a Mockito-mocked org.slf4j.Logger. The production class still uses
  slf4j-api exclusively. NoOpAnalysisWarningsTest now verifies via
  verify(logger).warn(...) calls (5 tests, +1 for null-message behavior).

- EngineLog gains a static current() accessor that returns the most
  recently installed instance. HostPluginIntegrationTest now reads
  EngineLog.current().messages() directly to assert no
  NoSuchBeanDefinitionException, instead of capturing via logback's
  ROOT logger ListAppender.

pom.xml: ch.qos.logback:logback-classic:1.5.13 dep removed entirely;
mvn dependency:tree confirms logback no longer reaches the test
classpath via any transitive route.

Verified: mvn test = 336/336 pass on the host JDK 21 (was 335; the
refactored NoOpAnalysisWarningsTest gained one additional test for
null-message behavior).

* fix(daemon): EngineLog.current uses AtomicReference, not volatile field (S3077)

SonarCloud's quality gate flagged the volatile EngineLog reference
added in the previous commit:

  java:S3077 — Use a thread-safe type; adding 'volatile' is not enough
  to make this field thread-safe.

Switched to AtomicReference<EngineLog>. The rule's intent is that
mutable-state shared between threads should use the j.u.c.atomic types
even when each individual read/write is atomic; volatile only handles
visibility, not compound operations a future caller might add.

Tests unchanged (336/336).

Author: aksOps

.github/workflows/ci.yml

@@ -16,11 +16,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '21'
           cache: maven
 
       - name: Set up Node.js (JS/TS analyzer tests need a Node runtime)

.github/workflows/parity.yml

@@ -49,11 +49,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '21'
 
       - name: Set up Node.js 20
         uses: actions/setup-node@v4

.github/workflows/publish.yml

@@ -50,11 +50,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up JDK 17 + GPG
+      - name: Set up JDK 21 + GPG
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '21'
           server-id: central
           server-username: OSS_NEXUS_USER
           server-password: OSS_NEXUS_PASS

.github/workflows/sonar.yml

@@ -39,12 +39,13 @@ jobs:
         with:
           fetch-depth: 0
 
-      # JDK 17 is the project's build/runtime target. Temurin is the safe default.
-      - name: Set up JDK 17
+      # JDK 21 is the project's build/runtime target (required by
+      # sonarlint-analysis-engine 11.x / LTA 2026.1). Temurin is the safe default.
+      - name: Set up JDK 21
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '21'
 
       # The JS/TS analyzer plugin spawns Node at runtime to lint JS/TS sources,
       # so Node must be on PATH when the scan runs (not just at build time).

README.md

@@ -98,7 +98,7 @@ The JSON output carries both fields on every issue.
 
 | Requirement | For |
 |---|---|
-| **Java 17+** (JDK or JRE) | running the CLI and daemon — auto-discovered (`JAVA_HOME` → `PATH` → common install locations) |
+| **Java 21+** (JDK or JRE) | running the CLI and daemon — auto-discovered (`JAVA_HOME` → `PATH` → common install locations) |
 | **Linux or macOS** | the daemon uses Unix domain sockets (Windows support is on the roadmap) |
 | **`git`** | the `check --diff` workflow |
 | **Node.js 18.17+** | JavaScript / TypeScript analysis |

pom.xml

@@ -54,32 +54,51 @@
     </issueManagement>
 
     <properties>
-        <maven.compiler.release>17</maven.compiler.release>
-        <maven.compiler.source>17</maven.compiler.source>
-        <maven.compiler.target>17</maven.compiler.target>
+        <!--
+          Java 21 minimum: sonarlint-analysis-engine 11.3.0.85510 (LTA 2026.1)
+          ships class files at major version 65 (Java 21). Compiling against
+          it requires a JDK 21+ toolchain. CI's setup-java step is pinned to
+          21 in .github/workflows/*.yml to match.
+        -->
+        <maven.compiler.release>21</maven.compiler.release>
+        <maven.compiler.source>21</maven.compiler.source>
+        <maven.compiler.target>21</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
         <jackson.version>2.17.2</jackson.version>
         <junit.version>5.10.2</junit.version>
-        <sonarlint.engine.version>10.24.0.81415</sonarlint.engine.version>
+        <!--
+          These versions track SonarQube Server 2026.1 LTA (released 2025-12-11).
+
+          To upgrade to a future LTA:
+            1. Look up the new LTA's bundled analyzer versions in the release
+               notes at https://docs.sonarsource.com/sonarqube-server/&lt;v&gt;/setup-and-upgrade/release-upgrade-notes/
+            2. Bump all 11 version properties below.
+            3. Run `mvn clean test` — the daemon test suite is the canary.
+            4. If a NEW required host bean appears (NoSuchBeanDefinitionException
+               on a type other than AnalysisWarnings), add an @SonarLintSide no-op
+               class in src/main/java/.../hostplugin/ and one context.addExtension(...)
+               line in SonarPredictHostPlugin.define(). See spec §7.2 for details.
+        -->
+        <sonarlint.engine.version>11.3.0.85510</sonarlint.engine.version>
         <picocli.version>4.7.7</picocli.version>
 
         <!--
           The 10 SonarSource analyzer plugins — the runtime assets the daemon
           loads. Single source of truth for the maven-dependency-plugin copy
           executions below, which fetch them through Maven (so settings.xml
-          mirrors / Nexus / proxy apply). Versions match engine 10.24.0.81415.
+          mirrors / Nexus / proxy apply). Versions match engine 11.3.0.85510 (LTA 2026.1).
         -->
-        <sonar.plugin.java.version>8.15.0.39343</sonar.plugin.java.version>
-        <sonar.plugin.python.version>5.5.0.23291</sonar.plugin.python.version>
-        <sonar.plugin.javascript.version>10.24.0.33043</sonar.plugin.javascript.version>
-        <sonar.plugin.php.version>3.46.0.13151</sonar.plugin.php.version>
-        <sonar.plugin.kotlin.version>3.2.0.7239</sonar.plugin.kotlin.version>
+        <sonar.plugin.java.version>8.29.0.43460</sonar.plugin.java.version>
+        <sonar.plugin.python.version>5.22.0.33216</sonar.plugin.python.version>
+        <sonar.plugin.javascript.version>12.5.0.41048</sonar.plugin.javascript.version>
+        <sonar.plugin.php.version>3.57.0.15976</sonar.plugin.php.version>
+        <sonar.plugin.kotlin.version>3.6.0.9326</sonar.plugin.kotlin.version>
         <sonar.plugin.go.version>1.18.1.827</sonar.plugin.go.version>
-        <sonar.plugin.ruby.version>1.19.0.471</sonar.plugin.ruby.version>
-        <sonar.plugin.scala.version>1.19.0.484</sonar.plugin.scala.version>
-        <sonar.plugin.html.version>3.19.0.5695</sonar.plugin.html.version>
-        <sonar.plugin.xml.version>2.13.0.5938</sonar.plugin.xml.version>
+        <sonar.plugin.ruby.version>1.22.0.1992</sonar.plugin.ruby.version>
+        <sonar.plugin.scala.version>1.23.0.2394</sonar.plugin.scala.version>
+        <sonar.plugin.html.version>3.27.0.7699</sonar.plugin.html.version>
+        <sonar.plugin.xml.version>2.17.0.7895</sonar.plugin.xml.version>
     </properties>
 
     <dependencyManagement>
@@ -129,6 +148,18 @@
             <artifactId>junit-jupiter</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.assertj</groupId>
+            <artifactId>assertj-core</artifactId>
+            <version>3.27.7</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.mockito</groupId>
+            <artifactId>mockito-core</artifactId>
+            <version>5.15.2</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
@@ -178,6 +209,27 @@
                         <phase>process-classes</phase>
                         <goals><goal>jar</goal></goals>
                     </execution>
+                    <execution>
+                        <id>host-plugin-jar</id>
+                        <phase>process-test-classes</phase>
+                        <goals><goal>jar</goal></goals>
+                        <configuration>
+                            <classifier>host</classifier>
+                            <includes>
+                                <include>io/github/randomcodespace/sonarpredict/hostplugin/**</include>
+                            </includes>
+                            <archive>
+                                <manifestEntries>
+                                    <Plugin-Class>io.github.randomcodespace.sonarpredict.hostplugin.SonarPredictHostPlugin</Plugin-Class>
+                                    <Plugin-Key>sonarpredict-host</Plugin-Key>
+                                    <Plugin-Name>Sonar Predictor Host</Plugin-Name>
+                                    <Plugin-Version>${project.version}</Plugin-Version>
+                                    <Sonar-Version>9.9</Sonar-Version>
+                                    <SonarLint-Supported>true</SonarLint-Supported>
+                                </manifestEntries>
+                            </archive>
+                        </configuration>
+                    </execution>
                 </executions>
             </plugin>
 
@@ -348,6 +400,42 @@
                 </executions>
             </plugin>
 
+            <!--
+              Copy the host plugin jar into the dev plugins/ directory so
+              that AnalysisService (no-arg constructor → plugins/) and
+              PluginRuntime.loadAll pick it up during mvn test.
+
+              The host-plugin-jar jar-plugin execution (process-test-classes)
+              produces target/sonar-predictor-${project.version}-host.jar.
+              This antrun execution binds to the SAME phase so it runs
+              immediately after the jar is written.
+
+              The file is gitignored (plugins/*.jar). In production the host
+              jar ships inside the dist zip's plugins/ directory via the
+              assembly descriptor, so no separate production step is needed.
+            -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <version>3.1.0</version>
+                <executions>
+                    <execution>
+                        <id>copy-host-plugin-for-tests</id>
+                        <phase>process-test-classes</phase>
+                        <goals><goal>run</goal></goals>
+                        <configuration>
+                            <target>
+                                <copy todir="${project.basedir}/plugins" overwrite="true">
+                                    <fileset dir="${project.build.directory}">
+                                        <include name="${project.artifactId}-${project.version}-host.jar"/>
+                                    </fileset>
+                                </copy>
+                            </target>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
             <!-- Assemble the dist bundle: bin/ launchers + lib/ fat jars +
                  plugins/ analyzer jars, zipped. Output:
                  target/sonar-predictor-dist-${project.version}.zip. -->

src/main/assembly/dist.xml

@@ -50,6 +50,17 @@
             </includes>
         </fileSet>
 
+        <!-- The host plugin JAR produced by the host-plugin-jar maven-jar-plugin
+             execution. Ships alongside the 10 analyzer JARs in plugins/ so the
+             daemon's PluginRuntime.loadAll picks it up via the *.jar glob. -->
+        <fileSet>
+            <directory>${project.build.directory}</directory>
+            <outputDirectory>plugins</outputDirectory>
+            <includes>
+                <include>sonar-predictor-*-host.jar</include>
+            </includes>
+        </fileSet>
+
         <!-- The two shaded fat jars produced by maven-shade-plugin's
              shade-cli + shade-daemon executions. Their on-disk names are
              sonar-predictor-{cli,daemon}-<version>.jar; the launcher

src/main/java/io/github/randomcodespace/sonarpredict/daemon/AnalysisService.java

@@ -20,7 +20,7 @@
 import java.util.stream.Stream;
 
 import org.sonarsource.sonarlint.core.analysis.AnalysisScheduler;
-import org.sonarsource.sonarlint.core.analysis.api.ActiveRule;
+import org.sonar.api.batch.rule.ActiveRule;
 import org.sonarsource.sonarlint.core.analysis.api.AnalysisConfiguration;
 import org.sonarsource.sonarlint.core.analysis.api.AnalysisResults;
 import org.sonarsource.sonarlint.core.analysis.api.AnalysisSchedulerConfiguration;
@@ -510,12 +510,8 @@ static List<ActiveRule> resolveActiveRules(
             }
             String languageKey = language.getSonarLanguageKey();
             for (String ruleKey : ruleKeys) {
-                ActiveRule activeRule = new ActiveRule(ruleKey, languageKey);
                 Map<String, String> params = paramDefaults.paramsFor(ruleKey);
-                if (!params.isEmpty()) {
-                    activeRule.setParams(params);
-                }
-                rules.add(activeRule);
+                rules.add(SimpleActiveRule.of(ruleKey, languageKey, params));
             }
         }
         return rules;
@@ -622,14 +618,10 @@ private List<ActiveRule> profileRulesFrom(String profileRef) {
             }
             // The analyzer-registered parameter defaults are the baseline; the
             // profile's own <parameters> override them where it sets a value.
-            ActiveRule active = new ActiveRule(rule.ruleKey(), languageKey);
             Map<String, String> params =
                     new java.util.HashMap<>(ruleParameterDefaults.paramsFor(rule.ruleKey()));
             params.putAll(rule.parameters());
-            if (!params.isEmpty()) {
-                active.setParams(Map.copyOf(params));
-            }
-            rules.add(active);
+            rules.add(SimpleActiveRule.of(rule.ruleKey(), languageKey, params));
         }
         return rules;
     }

src/main/java/io/github/randomcodespace/sonarpredict/daemon/EngineLog.java

@@ -2,6 +2,7 @@
 
 import java.util.List;
 import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.atomic.AtomicReference;
 
 import org.sonarsource.sonarlint.core.commons.log.LogOutput;
 import org.sonarsource.sonarlint.core.commons.log.SonarLintLogger;
@@ -21,6 +22,8 @@
  */
 public final class EngineLog implements LogOutput {
 
+    private static final AtomicReference<EngineLog> CURRENT = new AtomicReference<>();
+
     private final List<String> messages = new CopyOnWriteArrayList<>();
 
     /**
@@ -47,9 +50,21 @@ public static void install() {
     public static EngineLog installAndCapture() {
         EngineLog target = new EngineLog();
         SonarLintLogger.get().setTarget(target);
+        CURRENT.set(target);
         return target;
     }
 
+    /**
+     * Returns the most recently {@link #install installed} {@code EngineLog},
+     * or {@code null} if none has been installed yet. Tests use this to assert
+     * on engine messages emitted by code paths (such as
+     * {@code PluginRuntime.loadAll}) that install their own {@code EngineLog}
+     * internally without exposing the reference.
+     */
+    public static EngineLog current() {
+        return CURRENT.get();
+    }
+
     @Override
     public void log(String formattedMessage, Level level) {
         if (formattedMessage != null) {

src/main/java/io/github/randomcodespace/sonarpredict/daemon/IssueMapper.java

@@ -41,7 +41,7 @@ private IssueMapper() {
     public static io.github.randomcodespace.sonarpredict.protocol.dto.Issue toDto(
             Issue engineIssue, Path baseDir, RuleCatalog catalog) {
         return map(
-                engineIssue.getRuleKey(),
+                engineIssue.getRuleKey().toString(),
                 resolveFilePath(engineIssue.getInputFile(), baseDir),
                 engineIssue.getTextRange(),
                 engineIssue.getMessage(),