Update to SonarQube

{
  "name": "sonar-dependency-risks",
  "description": "Search for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default project)",
  "included_files": [],
  "skill_md_contents": "---\nname: sonar-dependency-risks\ndescription: Search for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default project)\nargument-hint: \"[project-key?] [--branch name] [--pr id]\"\nallowed-tools: Read, Grep, Bash(docker ps:*), Bash(podman ps:*), Bash(nerdctl ps:*), Bash(sonar:*)\n---\n\n# SonarQube — Dependency Risks\n\nSearch for dependency risks (software composition analysis issues) in a SonarQube project, paired with the releases that appear in the analysed project, application, or portfolio.\n\n## Usage\n\n```\nsonar-dependency-risks                    # risks in the current project\nsonar-dependency-risks my-project         # risks in a specific project\nsonar-dependency-risks my-project --branch feature/auth\nsonar-dependency-risks my-project --pr 42\n```\n\n## Prerequisites\n\nThis skill requires SonarQube Advanced Security (available on SonarQube Cloud Enterprise plan, or SonarQube Server 2025.4 Enterprise edition or higher), the SonarQube MCP Server to be configured, and the tool `mcp__sonarqube__search_dependency_risks` to be available in your session.\n\n**Before proceeding**, verify the tool is accessible. If it is not, try the CLI fallback in Step 3 before giving up — don't invent other CLI commands (e.g. `sonar mcp call` or `sonar dependency-risks` do not exist).\n\n**If the CLI fallback also fails or doesn't apply, narrow down the cause** — check whether the `sonarqube` MCP server is enabled in this agent's configuration. (This only explains missing tools, not the Advanced Security entitlement — see the first cause below.)\n\n- **Not enabled / not registered** → recommend running the sonar-integrate skill.\n- **Enabled but its tools are still unavailable** → configuration is correct but the server failed to start. The most common cause is that the container runtime is not running — the MCP server launches inside Docker/Podman/Nerdctl via `sonar run mcp`, so a correctly configured server still produces no tools if the daemon is stopped. Run `docker ps` yourself (falling back to `podman ps` / `nerdctl ps`) to confirm which cause applies: if it errors, the runtime is down; after the user starts it, confirm the same command succeeds before asking them to restart the agent session.\n\nEither way, show the user:\n\n> Unable to fetch dependency risks.\n>\n> **Possible causes:**\n> - This feature requires SonarQube Advanced Security — available on SonarQube Cloud Enterprise edition, or SonarQube Server 2025.4 Enterprise or higher\n> - MCP server not registered — invoke the sonar-integrate skill to configure the SonarQube MCP Server, then restart the agent session\n> - Container runtime not running — the SonarQube MCP Server runs inside a container (Docker, Podman, or Nerdctl); start your container runtime, then restart the agent session\n> - Credentials not configured — invoke the sonar-integrate skill\n> - Project key is wrong or no default project in MCP config — pass an explicit key, or verify `sonar-project.properties` / re-run the sonar-integrate skill for this project\n\nThen ask the user (yes/no) whether to run the sonar-integrate skill now. Briefly explain what it does: it checks the SonarQube setup on their machine — installing or updating `sonarqube-cli` and verifying authentication — and re-configures the integration for this agent, including the SonarQube MCP server and secrets-scanning hooks. If they confirm, invoke the sonar-integrate skill yourself and follow it end-to-end in this session, then ask the user to ensure a container runtime (Docker, Podman, or Nerdctl) is running and to restart the agent session so the new MCP tools become available; if they decline, stop.\n\n## Instructions\n\n### Step 1: Resolve the project key (only when needed)\n\nMCP tools sometimes **do not require** `projectKey` after the sonar-integrate skill has stored the default project for this workspace. Resolve a key only when you must pass it (tool schema requires it, or the user targets another project):\n\n- If the user provided a project key, use it.\n- Otherwise look for `sonar.projectKey` in `sonar-project.properties` at the repo root.\n- If still not found, **omit `projectKey`** in MCP calls and rely on the integration default.\n\n### Step 2: Parse optional flags from the user-provided arguments\n\n| Flag              | Maps to parameter |\n| ----------------- | ----------------- |\n| `--branch <name>` | `branchKey`       |\n| `--pr <id>`       | `pullRequestKey`  |\n\n### Step 3: Call `mcp__sonarqube__search_dependency_risks`\n\nInclude **`projectKey` only if** you resolved one in Step 1 **and** the tool requires it; otherwise omit it.\n\n```json\n{\n  \"projectKey\": \"<only-if-required>\",\n  \"branchKey\": \"<name>\",       // if --branch was given\n  \"pullRequestKey\": \"<id>\"     // if --pr was given\n}\n```\n\nOmit `projectKey` from the payload when the integration default applies. Omit unused optional fields.\n\n**If `mcp__sonarqube__search_dependency_risks` is unavailable, fall back to the CLI.** This needs an explicit project key — if none was resolved in Step 1, ask the user or invoke sonar-list-projects, then stop.\n\nRun `sonar auth status` to check the connected server. On a self-hosted **SonarQube Server**:\n\n```bash\nsonar api get \"/api/v2/sca/issues-releases?projectKey=<project-key>[&branchKey=<name>][&pullRequestKey=<id>]\"\n```\n\nOn **SonarQube Cloud**, `sonar api` can't reach this endpoint yet (lives on a separate subdomain; may change in a future CLI release) — run a fresh scan instead:\n\n```bash\nsonar analyze dependency-risks -p <project-key> --format table\n```\n\nThis re-scans manifests rather than querying prior results, so it may surface issues not yet on the server dashboard — expected, not an error. Map its output into the same table as Step 4.\n\nIf this also fails, show the standard message above — don't guess further commands.\n\n### Step 4: Format the results\n\n**If risks are found**, group by severity and present as a table:\n\n```markdown\n## Dependency Risks — `my-project` (branch: `main`)\n\nFound **5 dependency risk(s)**:\n\n### Critical\n| Dependency | Version | Risk                  | CVE            |\n| ---------- | ------- | --------------------- | -------------- |\n| log4j-core | 2.14.1  | Remote code execution | CVE-2021-44228 |\n\n### High\n| Dependency       | Version | Risk                          | CVE            |\n| ---------------- | ------- | ----------------------------- | -------------- |\n| jackson-databind | 2.12.3  | Deserialization vulnerability | CVE-2021-46877 |\n| commons-text     | 1.9     | Remote code execution         | CVE-2022-42889 |\n\n### Medium\n| Dependency    | Version | Risk              | CVE            |\n| ------------- | ------- | ----------------- | -------------- |\n| spring-web    | 5.3.18  | DoS vulnerability | CVE-2022-22965 |\n| netty-handler | 4.1.68  | SSL/TLS issue     | CVE-2021-43797 |\n```\n\nOmit columns that are not present in the response. Omit severity sections that have no risks.\n\n**If no risks are found**:\n\n```markdown\n## Dependency Risks — `my-project`\n\n✅ No dependency risks found.\n```\n\n### Step 5: Next steps\n\n- To fix a vulnerable dependency: *\"Ask me to update `<dependency>` to a safe version.\"*\n- To check the quality gate: *\"Invoke the sonar-quality-gate skill (add a project key only if you are not using the integration default).\"*\n- To check code-level security issues: *\"Invoke the sonar-list-issues skill with the project key (or use `sonar.projectKey` in the repo) with filters as needed — `sonar list issues` always requires `-p`.\"*\n"
}