Automated SonarQube Cloud PR Comment Handling and Fixing

Description and use

Implementation of a sonar-fix skill to automatically fix low-risk SonarQube issues and block PR merges when the Quality Gate fails.

Problem

The existing PR workflow (pr-work) only checks GitHub Checks for merge readiness. It fails to detect Quality Gate failures reported as PR comments by sonarcloud[bot], allowing PRs with static analysis regressions to merge.

Outcome

Implemented a sonar-fix skill that integrates with the PR workflow to automatically resolve low-risk SonarQube issues and enforce Quality Gate compliance before merging.

Workflow

• Parse sonarcloud[bot] PR comments using gh pr view --comments and GitHub API.
• Classify issues by rule_id and severity.
• Apply codified fixes for whitelisted risk-low rules (S1481, S1854, S1192, S1128, S125, S1116).
• Escalate non-whitelisted or complex issues.
• Verify Quality Gate status; if PASS, return control to pr-work for merge.
• Block merge if Quality Gate FAILs, even if GitHub Checks are green.

Evidence

Today pr-work only gates on gh pr checks... a FAIL Quality Gate that lands as a PR comment... is invisible to the merge logic

Source

The new sonar-fix skill parses sonarcloud[bot] PR comments, classifies issues... applies codified fixes

Source