SonarCloud

If your team uses SonarCloud, Limn can read its analysis of each pull request: the quality gate, issues, security hotspots and SonarCloud’s advice on how to fix them. AI Review uses them as evidence, the AI Review tab lists them, AI Fix can fix them, and Limn can post them to the pull request as one GitHub review. Limn only reads from SonarCloud; it never changes anything there.

#What you need

• A SonarCloud organisation that analyses your pull requests.
• A SonarCloud token. Create one in SonarCloud under My Account → Security.
• The organisation key.

#Set it up

1. Open Settings → Integrations and find SonarCloud.
2. Enter the Organization key and paste the Token.
3. Check the Project keys. Each repository uses SonarCloud’s own default, owner_repo. Type a key only if yours is different.
4. Press Save, then Test connection. Each repository is marked Found or Not found.

#What Limn reads

For each pull request, Limn reads SonarCloud’s analysis when a review runs, when you press Refresh, and when AI Fix opens. Opening a tab never calls SonarCloud; it shows what was read before.

• The quality gate and each failing condition in words, with the files behind it, for example coverage on new code.
• Open issues and security hotspots, the most severe first, up to 50, with the total (“50 of 132”).
• For each one: the rule, the flagged lines, why it matters and how to fix it.

#Where you see it

• AI Review: the reviewer is given the gate and the most severe items as evidence. It raises a finding only where it agrees, and does not copy the list.
• The AI Review tab: a SonarCloud section for the pull request’s latest commit, with the gate, each item with its place (a link into Changes), its lines and How to fix. When the review above it is of an older commit, the section says so.
• AI Fix: the failing gate conditions and the issues appear under SonarCloud issues in the list of things to fix. See Choose what to fix.

Post to GitHub

Post SonarCloud findings posts one GitHub review for the commit, under your account. An issue on a changed line gets its own comment on that line; everything else goes in the review’s summary. An issue already posted for an earlier commit is not posted again. The line under the button then says, for example, “Posted to GitHub: 12 on the changed lines, 5 in the summary, 3 already there from an earlier commit.”

With auto-posting on, Limn posts SonarCloud’s findings after each auto review, unless you turn that off. When SonarCloud finishes after the review, Limn posts them when the analysis lands, for up to 2 hours. See Verdicts and posting.

#Turn it off

In Settings → Integrations → SonarCloud, remove the token and press Save. Limn stops reading SonarCloud for that workspace. Each workspace has its own setting.