Sonar ruleset significantly influence BMW's development workflows. To ensure smooth integration and minimal disruption, it is essential that any changes to these rules—including minor adjustments—are communicated in advance. Developer teams require early access to updated rule definitions so they can validate their code against them before the changes are enforced in Cloud Manager pipelines.
Use-case:
BMW experienced a situation where a previously successful pipeline began failing overnight due to newly detected Sonar vulnerabilities, despite being based on the same commit. This indicates that the Sonar ruleset had changed unexpectedly from one day to the next.
Given BMW’s multi-project setup—comprising around 10 interdependent projects managed by different development teams—each project is built through its own pipeline. As a result, a Sonar scan failure in any one pipeline can have a significant ripple effect across the entire development landscape.
Current/Experienced Behavior:
A Sonar scan failure in any one pipeline can have a significant ripple effect across the entire development landscape.
Improved/Expected Behavior:
To ensure smooth integration and minimal disruption, it is essential that any changes to these rules—including minor adjustments—are communicated in advance.
Environment Details (AEM version/service pack, any other specifics if applicable):
Feature requested as well by other customers, requiring notifications and documentations regarding Sonar Rules changes with an impact on pipeline executions.
@Garima21 Thanks for proposing this idea. This has been reported to the engineering under the internal reference SITES-34847. The product team will triage this request to verify feasibility based on the prioritization model. This post will be updated according to Jira's status.