← SonarQubeCONTENT HISTORY
WHAT CHANGED
changed
Update to SonarQube
Snapshot Oct 28, 2026 · 12:32 UTC · version 2.7.0
Collection source: downloaded plugin package. These snapshots do not have a confirmed matching collection source. Differences in file lists alone do not establish changes to the package.
Instructions updated for sonar-list-issues
Skill instructions — Now says: --- name: sonar-list-issues description: Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always...
Observed in instructions or declared skills. Runtime behavior has not been tested.
Save SonarQube and check future changes in Following.
Up to 3 plugins free · no card required.
All fields and original values.
Skill instructions
Before
Sep 30, 2026 · 23:13 UTC
--- name: sonar-list-issues description: Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties) ar...
After
Oct 28, 2026 · 12:32 UTC
--- name: sonar-list-issues description: Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties) ...
Compare saved observations
Download comparison JSONSKILL.md text changes
− removed · + added
--- before +++ after @@ -1,116 +1,116 @@ ---- -name: sonar-list-issues -description: Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties) -argument-hint: "[project-key?] [--severities values] [--statuses values] [--branch name]" -allowed-tools: Read, Grep, Bash(sonar:*) ---- - -# SonarQube — List Issues - -Search for issues in a SonarQube project using the `sonarqube-cli`. - -Unlike SonarQube MCP tools (which may use a default project from integration), **`sonar list issues` always requires `-p <project-key>`**. Resolve the key from the user-provided arguments or `sonar-project.properties` before running the CLI. - -## Usage - -``` -sonar-list-issues # issues in the current project -sonar-list-issues my-project # issues in a specific project key -sonar-list-issues my-project --severities CRITICAL,BLOCKER # filter by severities -sonar-list-issues my-project --statuses OPEN,CONFIRMED # filter by status -sonar-list-issues my-project --branch main # on a specific branch -sonar-list-issues my-project --pr 42 # on a pull request -``` - -## Prerequisites - -This skill uses the `sonarqube-cli` command. The CLI must be installed and authenticated before proceeding. - -**Before proceeding**, verify that `sonar` is available on your PATH and authenticated. If it is not, do not attempt to call any alternative commands or invent alternatives, and show the user: - -> Unable to list issues. -> -> **Possible causes:** -> - `sonarqube-cli` not installed or not authenticated — invoke the sonar-integrate skill -> - Project key is wrong or missing — `-p` is mandatory for `sonar list issues`; invoke the sonar-list-projects skill or set `sonar.projectKey` in `sonar-project.properties` - -Then ask the user (yes/no) whether to run the sonar-integrate skill now. Briefly explain what it does: it checks the SonarQube setup on their machine — installing or updating `sonarqube-cli` and verifying authentication — and re-configures the integration for this agent, including the SonarQube MCP server and secrets-scanning hooks. If they confirm, invoke the sonar-integrate skill yourself and follow it end-to-end in this session, then re-check and continue; if they decline, stop. - -## Instructions - -### Step 1: Resolve the project key - -This flow uses **`sonar list issues`** (CLI), not MCP. The CLI **always** needs **`-p <project-key>`** — do not invoke it without a resolved key. - -- If the user provided a project key, use it. -- Otherwise look for `sonar.projectKey` in `sonar-project.properties` at the repo root. -- If still not found, **do not run** `sonar list issues`. Tell the user: *"Invoke the sonar-list-projects skill to find your project key, then re-run with that key,"* or add `sonar.projectKey` to `sonar-project.properties`. (MCP integration defaults do **not** apply to this CLI command.) - -### Step 2: Parse optional flags from the user-provided arguments - -| Flag | Maps to CLI option | -| ------------------------ | ------------------ | -| `--severities <values>` | `--severities` | -| `--statuses <values>` | `--statuses` | -| `--branch <name>` | `--branch` | -| `--pr <id>` | `--pull-request` | - -> `sonar list issues` does **not** support filtering by issue type, rule, tag, or component, nor a `--resolved` flag. Only the options above (plus `--format`, `--page`, and `--page-size`) exist. To filter by rule/type/tag/component or to drill into a single file, use the MCP-based skills (e.g. sonar-analyze for a file, or `mcp__sonarqube__search_sonar_issues_in_projects`). - -### Step 3: Validate arguments - -Before building the command, validate each user-supplied value against the following rules. If any value fails validation, stop and tell the user what was rejected and why — do not run the command. Validate the resolved project key (from args or `sonar-project.properties`) against the project-key pattern before running the CLI. - -| Argument | Allowed pattern | -| -------------- | ------------------------------------------------------------------------------------- | -| project key | `^[a-zA-Z0-9_\-\.:]+$` | -| `--severities` | comma-separated subset of: `INFO`, `MINOR`, `MAJOR`, `CRITICAL`, `BLOCKER`, `HIGH`, `MEDIUM`, `LOW` | -| `--statuses` | comma-separated subset of: `OPEN`, `CONFIRMED`, `FALSE_POSITIVE`, `ACCEPTED`, `FIXED` | -| `--branch` | `^[a-zA-Z0-9_\-\./]+$` | -| `--pr` | digits only | - -### Step 4: Run `sonar list issues` - -Build and run the command using a shell command. **Always** pass **`-p`** with the key resolved in Step 1. - -```bash -sonar list issues -p <project-key> --format toon [--severities <values>] [--statuses <values>] [--branch <name>] [--pull-request <id>] -``` - -Only include optional flags that were provided. - -### Step 5: Format the results - -**If issues are found**, present a summary line then a table sorted by severity then line number: - -```markdown -## SonarQube Issues — `my-project` (branch: `main`) - -Found **12 issue(s)**: - -| File | Line | Severity | Rule | Message | -| -------------------- | ---- | --------- | ------------ | ----------------------------- | -| src/auth/login.py | 12 | 🔴 Blocker | python:S2077 | SQL injection risk | -| src/utils/helpers.py | 34 | 🟠 High | python:S2259 | Null dereference | -| src/api/routes.py | 67 | 🟡 Medium | python:S3776 | Cognitive complexity too high | -``` - -Severity icons (the label depends on the server version): -- 🔴 Blocker -- 🟠 Critical / High -- 🟡 Major / Medium -- 🔵 Minor / Low -- ⚪ Info - -**If no issues are found**: - -```markdown -## SonarQube Issues — `my-project` - -✅ No issues found. -``` - -### Step 6: Next steps - -- To fix a specific issue: *"Ask me to fix `<rule>` at `<file>:<line>`."* -- To check the quality gate: *"Invoke the sonar-quality-gate skill."* +--- +name: sonar-list-issues +description: Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties) +argument-hint: "[project-key?] [--severities values] [--statuses values] [--branch name]" +allowed-tools: Read, Grep, Bash(sonar:*) +--- + +# SonarQube — List Issues + +Search for issues in a SonarQube project using the `sonarqube-cli`. + +Unlike SonarQube MCP tools (which may use a default project from integration), **`sonar list issues` always requires `-p <project-key>`**. Resolve the key from the user-provided arguments or `sonar-project.properties` before running the CLI. + +## Usage + +``` +sonar-list-issues # issues in the current project +sonar-list-issues my-project # issues in a specific project key +sonar-list-issues my-project --severities CRITICAL,BLOCKER # filter by severities +sonar-list-issues my-project --statuses OPEN,CONFIRMED # filter by status +sonar-list-issues my-project --branch main # on a specific branch +sonar-list-issues my-project --pr 42 # on a pull request +``` + +## Prerequisites + +This skill uses the `sonarqube-cli` command. The CLI must be installed and authenticated before proceeding. + +**Before proceeding**, verify that `sonar` is available on your PATH and authenticated. If it is not, do not attempt to call any alternative commands or invent alternatives, and show the user: + +> Unable to list issues. +> +> **Possible causes:** +> - `sonarqube-cli` not installed or not authenticated — invoke the sonar-integrate skill +> - Project key is wrong or missing — `-p` is mandatory for `sonar list issues`; invoke the sonar-list-projects skill or set `sonar.projectKey` in `sonar-project.properties` + +Then ask the user (yes/no) whether to run the sonar-integrate skill now. Briefly explain what it does: it checks the SonarQube setup on their machine — installing or updating `sonarqube-cli` and verifying authentication — and re-configures the integration for this agent, including the SonarQube MCP server and secrets-scanning hooks. If they confirm, invoke the sonar-integrate skill yourself and follow it end-to-end in this session, then re-check and continue; if they decline, stop. + +## Instructions + +### Step 1: Resolve the project key + +This flow uses **`sonar list issues`** (CLI), not MCP. The CLI **always** needs **`-p <project-key>`** — do not invoke it without a resolved key. + +- If the user provided a project key, use it. +- Otherwise look for `sonar.projectKey` in `sonar-project.properties` at the repo root. +- If still not found, **do not run** `sonar list issues`. Tell the user: *"Invoke the sonar-list-projects skill to find your project key, then re-run with that key,"* or add `sonar.projectKey` to `sonar-project.properties`. (MCP integration defaults do **not** apply to this CLI command.) + +### Step 2: Parse optional flags from the user-provided arguments + +| Flag | Maps to CLI option | +| ------------------------ | ------------------ | +| `--severities <values>` | `--severities` | +| `--statuses <values>` | `--statuses` | +| `--branch <name>` | `--branch` | +| `--pr <id>` | `--pull-request` | + +> `sonar list issues` does **not** support filtering by issue type, rule, tag, or component, nor a `--resolved` flag. Only the options above (plus `--format`, `--page`, and `--page-size`) exist. To filter by rule/type/tag/component or to drill into a single file, use the MCP-based skills (e.g. sonar-analyze for a file, or `mcp__sonarqube__search_sonar_issues_in_projects`). + +### Step 3: Validate arguments + +Before building the command, validate each user-supplied value against the following rules. If any value fails validation, stop and tell the user what was rejected and why — do not run the command. Validate the resolved project key (from args or `sonar-project.properties`) against the project-key pattern before running the CLI. + +| Argument | Allowed pattern | +| -------------- | ------------------------------------------------------------------------------------- | +| project key | `^[a-zA-Z0-9_\-\.:]+$` | +| `--severities` | comma-separated subset of: `INFO`, `MINOR`, `MAJOR`, `CRITICAL`, `BLOCKER`, `HIGH`, `MEDIUM`, `LOW` | +| `--statuses` | comma-separated subset of: `OPEN`, `CONFIRMED`, `FALSE_POSITIVE`, `ACCEPTED`, `FIXED` | +| `--branch` | `^[a-zA-Z0-9_\-\./]+$` | +| `--pr` | digits only | + +### Step 4: Run `sonar list issues` + +Build and run the command using a shell command. **Always** pass **`-p`** with the key resolved in Step 1. + +```bash +sonar list issues -p <project-key> --format toon [--severities <values>] [--statuses <values>] [--branch <name>] [--pull-request <id>] +``` + +Only include optional flags that were provided. + +### Step 5: Format the results + +**If issues are found**, present a summary line then a table sorted by severity then line number: + +```markdown +## SonarQube Issues — `my-project` (branch: `main`) + +Found **12 issue(s)**: + +| File | Line | Severity | Rule | Message | +| -------------------- | ---- | --------- | ------------ | ----------------------------- | +| src/auth/login.py | 12 | 🔴 Blocker | python:S2077 | SQL injection risk | +| src/utils/helpers.py | 34 | 🟠 High | python:S2259 | Null dereference | +| src/api/routes.py | 67 | 🟡 Medium | python:S3776 | Cognitive complexity too high | +``` + +Severity icons (the label depends on the server version): +- 🔴 Blocker +- 🟠 Critical / High +- 🟡 Major / Medium +- 🔵 Minor / Low +- ⚪ Info + +**If no issues are found**: + +```markdown +## SonarQube Issues — `my-project` + +✅ No issues found. +``` + +### Step 6: Next steps + +- To fix a specific issue: *"Ask me to fix `<rule>` at `<file>:<line>`."* +- To check the quality gate: *"Invoke the sonar-quality-gate skill."*
Full technical diff · 1 changed fields
changed /skill_md_contents
BEFORE
"---\nname: sonar-list-issues\ndescription: Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties)\nargument-hint: \"[project-key?] [--severities values] [--statuses values] [--branch name]\"\nallowed-tools: Read, Grep, Bash(sonar:*)\n---\n\n# SonarQube — List Issues\n\nSearch for issues in a SonarQube project using the `sonarqube-cli`.\n\nUnlike SonarQube MCP tools (which may use a default project from integration), **`sonar list issues` always requires `-p <project-key>`**. Resolve the key from the user-provided arguments or `sonar-project.properties` before running the CLI.\n\n## Usage\n\n```\nsonar-list-issues # issues in the current project\nsonar-list-issues my-project # issues in a specific project key\nsonar-list-issues my-project --severities CRITICAL,BLOCKER # filter by severities\nsonar-list-issues my-project --statuses OPEN,CONFIRMED # filter by status\nsonar-list-issues my-project --branch main # on a specific branch\nsonar-list-issues my-project --pr 42 # on a pull request\n```\n\n## Prerequisites\n\nThis skill uses the `sonarqube-cli` command. The CLI must be installed and authenticated before proceeding.\n\n**Before proceeding**, verify that `sonar` is available on your PATH and authenticated. If it is not, do not attempt to call any alternative commands or invent alternatives, and show the user:\n\n> Unable to list issues.\n>\n> **Possible causes:**\n> - `sonarqube-cli` not installed or not authenticated — invoke the sonar-integrate skill\n> - Project key is wrong or missing — `-p` is mandatory for `sonar list issues`; invoke the sonar-list-projects skill or set `sonar.projectKey` in `sonar-project.properties`\n\nThen ask the user (yes/no) whether to run the sonar-integrate skill now. Briefly explain what it does: it checks the SonarQube setup on their machine — installing or updating `sonarqube-cli` and verifying authentication — and re-configures the integration for this agent, including the SonarQube MCP server and secrets-scanning hooks. If they confirm, invoke the sonar-integrate skill yourself and follow it end-to-end in this session, then re-check and continue; if they decline, stop.\n\n## Instructions\n\n### Step 1: Resolve the project key\n\nThis flow uses **`sonar list issues`** (CLI), not MCP. The CLI **always** needs **`-p <project-key>`** — do not invoke it without a resolved key.\n\n- If the user provided a project key, use it.\n- Otherwise look for `sonar.projectKey` in `sonar-project.properties` at the repo root.\n- If still not found, **do not run** `sonar list issues`. Tell the user: *\"Invoke the sonar-list-projects skill to find your project key, then re-run with that key,\"* or add `sonar.projectKey` to `sonar-project.properties`. (MCP integration defaults do **not** apply to this CLI command.)\n\n### Step 2: Parse optional flags from the user-provided arguments\n\n| Flag | Maps to CLI option |\n| ------------------------ | ------------------ |\n| `--severities <values>` | `--severities` |\n| `--statuses <values>` | `--statuses` |\n| `--branch <name>` | `--branch` |\n| `--pr <id>` | `--pull-request` |\n\n> `sonar list issues` does **not** support filtering by issue type, rule, tag, or component, nor a `--resolved` flag. Only the options above (plus `--format`, `--page`, and `--page-size`) exist. To filter by rule/type/tag/component or to drill into a single file, use the MCP-based skills (e.g. sonar-analyze for a file, or `mcp__sonarqube__search_sonar_issues_in_projects`).\n\n### Step 3: Validate arguments\n\nBefore building the command, validate each user-supplied value against the following rules. If any value fails validation, stop and tell the user what was rejected and why — do not run the command. Validate the resolved project key (from args or `sonar-project.properties`) against the project-key pattern before running the CLI.\n\n| Argument | Allowed pattern |\n| -------------- | ------------------------------------------------------------------------------------- |\n| project key | `^[a-zA-Z0-9_\\-\\.:]+$` |\n| `--severities` | comma-separated subset of: `INFO`, `MINOR`, `MAJOR`, `CRITICAL`, `BLOCKER`, `HIGH`, `MEDIUM`, `LOW` |\n| `--statuses` | comma-separated subset of: `OPEN`, `CONFIRMED`, `FALSE_POSITIVE`, `ACCEPTED`, `FIXED` |\n| `--branch` | `^[a-zA-Z0-9_\\-\\./]+$` |\n| `--pr` | digits only |\n\n### Step 4: Run `sonar list issues`\n\nBuild and run the command using a shell command. **Always** pass **`-p`** with the key resolved in Step 1.\n\n```bash\nsonar list issues -p <project-key> --format toon [--severities <values>] [--statuses <values>] [--branch <name>] [--pull-request <id>]\n```\n\nOnly include optional flags that were provided.\n\n### Step 5: Format the results\n\n**If issues are found**, present a summary line then a table sorted by severity then line number:\n\n```markdown\n## SonarQube Issues — `my-project` (branch: `main`)\n\nFound **12 issue(s)**:\n\n| File | Line | Severity | Rule | Message |\n| -------------------- | ---- | --------- | ------------ | ----------------------------- |\n| src/auth/login.py | 12 | 🔴 Blocker | python:S2077 | SQL injection risk |\n| src/utils/helpers.py | 34 | 🟠 High | python:S2259 | Null dereference |\n| src/api/routes.py | 67 | 🟡 Medium | python:S3776 | Cognitive complexity too high |\n```\n\nSeverity icons (the label depends on the server version):\n- 🔴 Blocker\n- 🟠 Critical / High\n- 🟡 Major / Medium\n- 🔵 Minor / Low\n- ⚪ Info\n\n**If no issues are found**:\n\n```markdown\n## SonarQube Issues — `my-project`\n\n✅ No issues found.\n```\n\n### Step 6: Next steps\n\n- To fix a specific issue: *\"Ask me to fix `<rule>` at `<file>:<line>`.\"*\n- To check the quality gate: *\"Invoke the sonar-quality-gate skill.\"*\n"
AFTER
"---\r\nname: sonar-list-issues\r\ndescription: Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties)\r\nargument-hint: \"[project-key?] [--severities values] [--statuses values] [--branch name]\"\r\nallowed-tools: Read, Grep, Bash(sonar:*)\r\n---\r\n\r\n# SonarQube — List Issues\r\n\r\nSearch for issues in a SonarQube project using the `sonarqube-cli`.\r\n\r\nUnlike SonarQube MCP tools (which may use a default project from integration), **`sonar list issues` always requires `-p <project-key>`**. Resolve the key from the user-provided arguments or `sonar-project.properties` before running the CLI.\r\n\r\n## Usage\r\n\r\n```\r\nsonar-list-issues # issues in the current project\r\nsonar-list-issues my-project # issues in a specific project key\r\nsonar-list-issues my-project --severities CRITICAL,BLOCKER # filter by severities\r\nsonar-list-issues my-project --statuses OPEN,CONFIRMED # filter by status\r\nsonar-list-issues my-project --branch main # on a specific branch\r\nsonar-list-issues my-project --pr 42 # on a pull request\r\n```\r\n\r\n## Prerequisites\r\n\r\nThis skill uses the `sonarqube-cli` command. The CLI must be installed and authenticated before proceeding.\r\n\r\n**Before proceeding**, verify that `sonar` is available on your PATH and authenticated. If it is not, do not attempt to call any alternative commands or invent alternatives, and show the user:\r\n\r\n> Unable to list issues.\r\n>\r\n> **Possible causes:**\r\n> - `sonarqube-cli` not installed or not authenticated — invoke the sonar-integrate skill\r\n> - Project key is wrong or missing — `-p` is mandatory for `sonar list issues`; invoke the sonar-list-projects skill or set `sonar.projectKey` in `sonar-project.properties`\r\n\r\nThen ask the user (yes/no) whether to run the sonar-integrate skill now. Briefly explain what it does: it checks the SonarQube setup on their machine — installing or updating `sonarqube-cli` and verifying authentication — and re-configures the integration for this agent, including the SonarQube MCP server and secrets-scanning hooks. If they confirm, invoke the sonar-integrate skill yourself and follow it end-to-end in this session, then re-check and continue; if they decline, stop.\r\n\r\n## Instructions\r\n\r\n### Step 1: Resolve the project key\r\n\r\nThis flow uses **`sonar list issues`** (CLI), not MCP. The CLI **always** needs **`-p <project-key>`** — do not invoke it without a resolved key.\r\n\r\n- If the user provided a project key, use it.\r\n- Otherwise look for `sonar.projectKey` in `sonar-project.properties` at the repo root.\r\n- If still not found, **do not run** `sonar list issues`. Tell the user: *\"Invoke the sonar-list-projects skill to find your project key, then re-run with that key,\"* or add `sonar.projectKey` to `sonar-project.properties`. (MCP integration defaults do **not** apply to this CLI command.)\r\n\r\n### Step 2: Parse optional flags from the user-provided arguments\r\n\r\n| Flag | Maps to CLI option |\r\n| ------------------------ | ------------------ |\r\n| `--severities <values>` | `--severities` |\r\n| `--statuses <values>` | `--statuses` |\r\n| `--branch <name>` | `--branch` |\r\n| `--pr <id>` | `--pull-request` |\r\n\r\n> `sonar list issues` does **not** support filtering by issue type, rule, tag, or component, nor a `--resolved` flag. Only the options above (plus `--format`, `--page`, and `--page-size`) exist. To filter by rule/type/tag/component or to drill into a single file, use the MCP-based skills (e.g. sonar-analyze for a file, or `mcp__sonarqube__search_sonar_issues_in_projects`).\r\n\r\n### Step 3: Validate arguments\r\n\r\nBefore building the command, validate each user-supplied value against the following rules. If any value fails validation, stop and tell the user what was rejected and why — do not run the command. Validate the resolved project key (from args or `sonar-project.properties`) against the project-key pattern before running the CLI.\r\n\r\n| Argument | Allowed pattern |\r\n| -------------- | ------------------------------------------------------------------------------------- |\r\n| project key | `^[a-zA-Z0-9_\\-\\.:]+$` |\r\n| `--severities` | comma-separated subset of: `INFO`, `MINOR`, `MAJOR`, `CRITICAL`, `BLOCKER`, `HIGH`, `MEDIUM`, `LOW` |\r\n| `--statuses` | comma-separated subset of: `OPEN`, `CONFIRMED`, `FALSE_POSITIVE`, `ACCEPTED`, `FIXED` |\r\n| `--branch` | `^[a-zA-Z0-9_\\-\\./]+$` |\r\n| `--pr` | digits only |\r\n\r\n### Step 4: Run `sonar list issues`\r\n\r\nBuild and run the command using a shell command. **Always** pass **`-p`** with the key resolved in Step 1.\r\n\r\n```bash\r\nsonar list issues -p <project-key> --format toon [--severities <values>] [--statuses <values>] [--branch <name>] [--pull-request <id>]\r\n```\r\n\r\nOnly include optional flags that were provided.\r\n\r\n### Step 5: Format the results\r\n\r\n**If issues are found**, present a summary line then a table sorted by severity then line number:\r\n\r\n```markdown\r\n## SonarQube Issues — `my-project` (branch: `main`)\r\n\r\nFound **12 issue(s)**:\r\n\r\n| File | Line | Severity | Rule | Message |\r\n| -------------------- | ---- | --------- | ------------ | ----------------------------- |\r\n| src/auth/login.py | 12 | 🔴 Blocker | python:S2077 | SQL injection risk |\r\n| src/utils/helpers.py | 34 | 🟠 High | python:S2259 | Null dereference |\r\n| src/api/routes.py | 67 | 🟡 Medium | python:S3776 | Cognitive complexity too high |\r\n```\r\n\r\nSeverity icons (the label depends on the server version):\r\n- 🔴 Blocker\r\n- 🟠 Critical / High\r\n- 🟡 Major / Medium\r\n- 🔵 Minor / Low\r\n- ⚪ Info\r\n\r\n**If no issues are found**:\r\n\r\n```markdown\r\n## SonarQube Issues — `my-project`\r\n\r\n✅ No issues found.\r\n```\r\n\r\n### Step 6: Next steps\r\n\r\n- To fix a specific issue: *\"Ask me to fix `<rule>` at `<file>:<line>`.\"*\r\n- To check the quality gate: *\"Invoke the sonar-quality-gate skill.\"*\r\n"
Full snapshot data
{
"description": "Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties)",
"included_files": [],
"name": "sonar-list-issues",
"skill_md_contents": "---\r\nname: sonar-list-issues\r\ndescription: Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties)\r\nargument-hint: \"[project-key?] [--severities values] [--statuses values] [--branch name]\"\r\nallowed-tools: Read, Grep, Bash(sonar:*)\r\n---\r\n\r\n# SonarQube — List Issues\r\n\r\nSearch for issues in a SonarQube project using the `sonarqube-cli`.\r\n\r\nUnlike SonarQube MCP tools (which may use a default project from integration), **`sonar list issues` always requires `-p <project-key>`**. Resolve the key from the user-provided arguments or `sonar-project.properties` before running the CLI.\r\n\r\n## Usage\r\n\r\n```\r\nsonar-list-issues # issues in the current project\r\nsonar-list-issues my-project # issues in a specific project key\r\nsonar-list-issues my-project --severities CRITICAL,BLOCKER # filter by severities\r\nsonar-list-issues my-project --statuses OPEN,CONFIRMED # filter by status\r\nsonar-list-issues my-project --branch main # on a specific branch\r\nsonar-list-issues my-project --pr 42 # on a pull request\r\n```\r\n\r\n## Prerequisites\r\n\r\nThis skill uses the `sonarqube-cli` command. The CLI must be installed and authenticated before proceeding.\r\n\r\n**Before proceeding**, verify that `sonar` is available on your PATH and authenticated. If it is not, do not attempt to call any alternative commands or invent alternatives, and show the user:\r\n\r\n> Unable to list issues.\r\n>\r\n> **Possible causes:**\r\n> - `sonarqube-cli` not installed or not authenticated — invoke the sonar-integrate skill\r\n> - Project key is wrong or missing — `-p` is mandatory for `sonar list issues`; invoke the sonar-list-projects skill or set `sonar.projectKey` in `sonar-project.properties`\r\n\r\nThen ask the user (yes/no) whether to run the sonar-integrate skill now. Briefly explain what it does: it checks the SonarQube setup on their machine — installing or updating `sonarqube-cli` and verifying authentication — and re-configures the integration for this agent, including the SonarQube MCP server and secrets-scanning hooks. If they confirm, invoke the sonar-integrate skill yourself and follow it end-to-end in this session, then re-check and continue; if they decline, stop.\r\n\r\n## Instructions\r\n\r\n### Step 1: Resolve the project key\r\n\r\nThis flow uses **`sonar list issues`** (CLI), not MCP. The CLI **always** needs **`-p <project-key>`** — do not invoke it without a resolved key.\r\n\r\n- If the user provided a project key, use it.\r\n- Otherwise look for `sonar.projectKey` in `sonar-project.properties` at the repo root.\r\n- If still not found, **do not run** `sonar list issues`. Tell the user: *\"Invoke the sonar-list-projects skill to find your project key, then re-run with that key,\"* or add `sonar.projectKey` to `sonar-project.properties`. (MCP integration defaults do **not** apply to this CLI command.)\r\n\r\n### Step 2: Parse optional flags from the user-provided arguments\r\n\r\n| Flag | Maps to CLI option |\r\n| ------------------------ | ------------------ |\r\n| `--severities <values>` | `--severities` |\r\n| `--statuses <values>` | `--statuses` |\r\n| `--branch <name>` | `--branch` |\r\n| `--pr <id>` | `--pull-request` |\r\n\r\n> `sonar list issues` does **not** support filtering by issue type, rule, tag, or component, nor a `--resolved` flag. Only the options above (plus `--format`, `--page`, and `--page-size`) exist. To filter by rule/type/tag/component or to drill into a single file, use the MCP-based skills (e.g. sonar-analyze for a file, or `mcp__sonarqube__search_sonar_issues_in_projects`).\r\n\r\n### Step 3: Validate arguments\r\n\r\nBefore building the command, validate each user-supplied value against the following rules. If any value fails validation, stop and tell the user what was rejected and why — do not run the command. Validate the resolved project key (from args or `sonar-project.properties`) against the project-key pattern before running the CLI.\r\n\r\n| Argument | Allowed pattern |\r\n| -------------- | ------------------------------------------------------------------------------------- |\r\n| project key | `^[a-zA-Z0-9_\\-\\.:]+$` |\r\n| `--severities` | comma-separated subset of: `INFO`, `MINOR`, `MAJOR`, `CRITICAL`, `BLOCKER`, `HIGH`, `MEDIUM`, `LOW` |\r\n| `--statuses` | comma-separated subset of: `OPEN`, `CONFIRMED`, `FALSE_POSITIVE`, `ACCEPTED`, `FIXED` |\r\n| `--branch` | `^[a-zA-Z0-9_\\-\\./]+$` |\r\n| `--pr` | digits only |\r\n\r\n### Step 4: Run `sonar list issues`\r\n\r\nBuild and run the command using a shell command. **Always** pass **`-p`** with the key resolved in Step 1.\r\n\r\n```bash\r\nsonar list issues -p <project-key> --format toon [--severities <values>] [--statuses <values>] [--branch <name>] [--pull-request <id>]\r\n```\r\n\r\nOnly include optional flags that were provided.\r\n\r\n### Step 5: Format the results\r\n\r\n**If issues are found**, present a summary line then a table sorted by severity then line number:\r\n\r\n```markdown\r\n## SonarQube Issues — `my-project` (branch: `main`)\r\n\r\nFound **12 issue(s)**:\r\n\r\n| File | Line | Severity | Rule | Message |\r\n| -------------------- | ---- | --------- | ------------ | ----------------------------- |\r\n| src/auth/login.py | 12 | 🔴 Blocker | python:S2077 | SQL injection risk |\r\n| src/utils/helpers.py | 34 | 🟠 High | python:S2259 | Null dereference |\r\n| src/api/routes.py | 67 | 🟡 Medium | python:S3776 | Cognitive complexity too high |\r\n```\r\n\r\nSeverity icons (the label depends on the server version):\r\n- 🔴 Blocker\r\n- 🟠 Critical / High\r\n- 🟡 Major / Medium\r\n- 🔵 Minor / Low\r\n- ⚪ Info\r\n\r\n**If no issues are found**:\r\n\r\n```markdown\r\n## SonarQube Issues — `my-project`\r\n\r\n✅ No issues found.\r\n```\r\n\r\n### Step 6: Next steps\r\n\r\n- To fix a specific issue: *\"Ask me to fix `<rule>` at `<file>:<line>`.\"*\r\n- To check the quality gate: *\"Invoke the sonar-quality-gate skill.\"*\r\n"
}SHA-256 of public snapshot: 73cf25aa44ef8368ae34e82a5a0f0f474e30ae7e157c687df010f4bd77ca64b0