SONARJAVA-6613 Implement new rule S9021

[romainbrenguier]

This rule detects Spring @configuration classes declared with the 'final' modifier, which prevents Spring from creating CGLIB proxies necessary for proper bean lifecycle management and singleton enforcement.

[hashicorp-vault-sonar-prod]

SONARJAVA-6613

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Implements rule S9021 to detect final @Configuration classes, resolving the limitation where meta-annotations were incorrectly identified. No remaining issues found.

✅ 1 resolved

✅ Edge Case: @configuration detected only as direct annotation, not meta-annotation

📄 java-checks/src/main/java/org/sonar/java/checks/spring/ConfigurationClassShouldNotBeFinalCheck.java:62-66
getConfigurationAnnotation() filters annotations by symbolType().is(SpringUtils.CONFIGURATION_ANNOTATION), which only matches a directly-applied @configuration. Composed/meta-annotations that are themselves @configuration (e.g. @SpringBootApplication, or custom stereotypes meta-annotated with @configuration) also create CGLIB-proxied configuration classes and would be affected by the same final problem, but are not detected here. Other Spring checks in this repo (e.g. SpringConfigurationWithAutowiredFieldsCheck) use symbol().metadata().isAnnotatedWith(...) to catch meta-annotations. If catching those cases is in scope, consider using metadata().isAnnotatedWith(CONFIGURATION_ANNOTATION); if intentionally limited to direct annotations, a test sample documenting the exclusion would make the intent clear.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Implements rule S9021 to detect final @Configuration classes, resolving the limitation where meta-annotations were incorrectly identified. No remaining issues found.

✅ 1 resolved

✅ Edge Case: @configuration detected only as direct annotation, not meta-annotation

📄 java-checks/src/main/java/org/sonar/java/checks/spring/ConfigurationClassShouldNotBeFinalCheck.java:62-66
getConfigurationAnnotation() filters annotations by symbolType().is(SpringUtils.CONFIGURATION_ANNOTATION), which only matches a directly-applied @configuration. Composed/meta-annotations that are themselves @configuration (e.g. @SpringBootApplication, or custom stereotypes meta-annotated with @configuration) also create CGLIB-proxied configuration classes and would be affected by the same final problem, but are not detected here. Other Spring checks in this repo (e.g. SpringConfigurationWithAutowiredFieldsCheck) use symbol().metadata().isAnnotatedWith(...) to catch meta-annotations. If catching those cases is in scope, consider using metadata().isAnnotatedWith(CONFIGURATION_ANNOTATION); if intentionally limited to direct annotations, a test sample documenting the exclusion would make the intent clear.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
97.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube