CLI-973 Add dependency risks global hook

[georgii-borovinskikh-sonarsource]

---

Summary by Gitar

• Dependency Risks Hook:
  • Enabled global support for dependency risks git hooks with graceful project resolution
  • Updated pre-commit hook to skip gracefully instead of hard-failing when project key is missing

_{This will update automatically on new commits.}

[netlify]

✅ Deploy Preview for sonarqube-cli canceled.

Name	Link
🔨 Latest commit	e76eacf
🔍 Latest deploy log	https://app.netlify.com/projects/sonarqube-cli/deploys/6aa907ff26cd2e00082094e3

[hashicorp-vault-sonar-prod]

CLI-973

[tomshafir-sonarsource]

Looks good! Left a few small comments.

[gitar-bot]

Code Review ✅ Approved 6 resolved / 6 findings

Enables global dependency risks git hook with graceful project resolution and prompts for opt-in during setup. Resolved issues include contradictory documentation on opt-out behavior, untested decline path and success path for lazy project discovery, generated docs still advertising removed command, and test ambient state leakage. No issues remain open.

✅ 6 resolved

✅ Quality: CLAUDE.md paragraph contradicts itself on dep-risks opt-out

📄 CLAUDE.md:69
The rewritten sentence opens with "installs a pre-commit dependency-risks (SCA) scan ... whenever SCA is available for the connection — there is no opt-in flag; a future --skip-dep-risks flag is the planned way to opt out non-interactively", but the same paragraph later states that interactive sessions get an Install pre-commit dependency-risks scan? prompt "so the choice can be declined on the spot instead of only via a later --skip-dep-risks flag". A reader (or agent) acting on the opening clause will believe the subfeature is always installed when SCA is available. Qualify the opening clause, e.g. "installs ... by default (auto-installed non-interactively, prompted with default Yes interactively)".

✅ Quality: Decline path for the new dep-risks prompt is untested

📄 tests/unit/commands/integrate/git/git-integration-subfeatures.test.ts:96-110 📄 tests/integration/specs/integrate/git.test.ts:715-724
The prompt introduces a brand-new outcome — the user answering No — which makes selectActiveSubfeatures drop pre-commit-dependency-risks, so the hook must render without --dependency-risks and sca-scanner-cli must not be installed. No test exercises it: the interactive integration test only accepts the prompt, and the unit tests now assert only that shouldInstall returns {action:'ask'} (the previous non-interactive install assertion was replaced by another ask assertion). Add an interactive integration case that declines Install pre-commit dependency-risks scan? and asserts the generated hook contains no --dependency-risks and the state has no sca-scanner-cli dependency.

✅ Quality: Generated docs still advertise removed integrate git --dependency-risks

📄 src/commands/command-tree.ts:403 📄 docs/index.html:649
This PR removes the --dependency-risks option from sonar integrate git (command-tree.ts) and updates the hand-maintained snippet in docs/index.html, but the other committed generator outputs were not regenerated: docs/llms.txt still shows Usage: sonar integrate git [...] [--dependency-risks] [-p <value>] and describes -p as "required with --dependency-risks", and docs/data/commands.json:558/565 still carry the removed option plus its old description. A user (or an LLM consuming llms.txt) following that usage line runs sonar integrate git --dependency-risks and gets an unknown-option error, since there is no CI check that diffs the generated docs against the tree. Re-run bun run gen:docs and commit the refreshed docs/llms.txt and docs/data/commands.json (and docs/commands.html if it changes).

✅ Quality: Lazy project discovery success path is untested

📄 tests/unit/commands/hook/git-pre-commit-dependency-risks.mocked.test.ts:190-193 📄 tests/unit/commands/hook/git-pre-commit-dependency-risks.mocked.test.ts:318-332 📄 src/commands/hook/git-pre-commit-dependency-risks.ts:75-85
The commit's whole point is resolving the project key via discoverProject when no -p was baked, but the added spy only ever resolves {projectRoot, configSources} (no projectKey), so every test either passes project: 'demo' explicitly or exercises the skip branch at line 103. Nothing asserts that a discovered key is what reaches ScaScanOrchestrator.run and the remediation hint, so a regression in resolveProjectKey (e.g. returning projectRoot instead of projectKey, or discovering before the manifest check) would pass CI. Add a test that makes discoverProject resolve a projectKey and assert the orchestrator is called with it.

✅ Quality: Dep-risks hook test now leaks noted-project ambient state

📄 tests/unit/commands/hook/git-pre-commit-dependency-risks.mocked.test.ts:188-202 📄 src/commands/hook/git-pre-commit-dependency-risks.ts:111
runDepRisksStage now calls noteProject(options.auth, project), so the tests that pass project: 'demo' set the module-global notedProject in src/core/telemetry/project-uuid.ts. That state outlives the test (bun shares the module registry across files), and src/core/telemetry/CLAUDE.md:40 states tests must call resetProjectUuidContextForTests() in beforeEach precisely so a leaked project cannot make a later project_uuid assertion pass for the wrong reason or trigger a resolve against FAKE_AUTH.serverUrl. Add the reset call to this file's beforeEach.

...and 1 more resolved from earlier reviews

Review coverage

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud