{
  "name": "sonarqube — 1 hook",
  "slug": "source-hooks-895c0724ba0156fbd5d3cc2d",
  "type": "hooks",
  "category": "developer-tools",
  "example": false,
  "evidence_state": "pinned_source_listing",
  "stamp": "Pinned source listing — machine-checked",
  "summary": "Pinned source declarations and file hashes were listed.",
  "outcome": "Listed 1 hook declaration. Ran 46 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
  "rule_results": [
    "The retained source tree matches its acquisition manifest.",
    "Declared hook names (listing.json): SessionStart"
  ],
  "task": "What declarations and files are present in this pinned source?",
  "setup": "Git blob acquisition followed by static source inspection.",
  "limitations": "Scope: acquisition and static inspection. Command results: commands.json.",
  "source_url": "https://github.com/SonarSource/sonarqube-agent-plugins.git",
  "documentation_url": "https://github.com/SonarSource/sonarqube-agent-plugins.git",
  "commit": "5a9356d957db063e4d2cf87511b44cc1ba88dc99",
  "tree_sha256": "36e7f36b5e612382c613691dfaefd8bc567cf3b9955515e85cc63dab2a7b0e6f",
  "file_sha256": {
    ".agents/plugins/marketplace.json": "a09533cc2d4a5dbed884353591ab8b6d61d3fb583ca797331af45d1c9484484e",
    ".claude-plugin/marketplace.json": "8856b2020a808546e2251001df245c9ec1327078faab8d04e0d6bb716bfa0826",
    ".claude-plugin/plugin.json": "a65858d032e7281e50a197eba2a8d180e066f2aa7264402e04577db6b2d4a71c",
    ".codex-plugin/plugin.json": "7a32f74e35de96a4313d6b900968cfb5079b3666ff7fde439f1dcec7c449a067",
    ".cursor-plugin/marketplace.json": "3985ef713f5159cd69b3fb319326fab3ecf3d9a44e91d26dbe88b15ec5506b06",
    ".cursor-plugin/plugin.json": "d3b768d5ceb52b74dc660a0a342b1565d7ff66f060c548a844f200addf196854",
    ".factory-plugin/marketplace.json": "1da72c735f06b4a7f988496acd5598167a5ed26896dd9b4cb836eaaeb48cde9d",
    ".factory-plugin/plugin.json": "26780fe75f425a4b0e1c05cf60e582d26358c51dd08d16846398acdde1b72b5a",
    ".github/CODEOWNERS": "3ecbd4a4c501695a25651bf18274da43715ed4f7581ef2d903ee96f6eeea5193",
    ".github/plugin/marketplace.json": "8856b2020a808546e2251001df245c9ec1327078faab8d04e0d6bb716bfa0826",
    ".github/plugin/plugin.json": "9cb2627036a4b8f288a6ef5c048cbc06c84c4536ebe5db76a30b8c17d8c88a04",
    ".github/renovate.json": "c049351f0cb07629effa5dcf2334668c4a901633d7d75ffc55f586863a2704ee",
    ".gitignore": "3ceeb56b31ab247687626eb9530979e2d5e1249ee7120fd0018374f6fd0a1515",
    "GEMINI.md": "d391a9a3936197db238a52edfc16e118db137d9b4eb4b89079092999de57a431",
    "LICENSE": "5ed3eff27f4bbbc595e91b06981eb3eee50fc3f7e7ca04c3fdb2c20f03569bd1",
    "README.md": "c5685d7a8b958b20b860ccb2169d70d56efeaf138f305adba6ec687fc0df3df2",
    "SECURITY.md": "ff94ac6750964ab542a0884019962bda31fee27450a356458e188d331fc18411",
    "agents/sonarqube-reviewer.agent.md": "b34a4fe6a1717b180bcd09da293571af6d7b23afa83d8c3244de6b447ea30de8",
    "assets/logo-dark.png": "fda3a22b9fa041ea7630ae6ac263da36a54ab5172d046102cd92693025338cb6",
    "assets/logo.png": "89048de870cebf93c7d7660ff434259da48f029536840d6c3d533678047ad84d",
    "assets/logo.svg": "f229ce40967152b9f6ec6bab2b4989cf65bb3d723c044fd3a9945db58a686028",
    "claude-hooks/hooks.json": "ca69a9b5a1f3f0b5bc07b29490743c66ce69ed022e0717700743cc2084946fdf",
    "droids/sonarqube-reviewer.md": "aa3b99272098d6daeb18602f0a557945fc95d4192435002c4925035486917015",
    "gemini-extension.json": "2c3cf2ab933033957dec14f07bb3e69c9a53bafc907a95aa7819f90e1e8def75",
    "kiro-power/POWER.md": "06756d58b713496afdcb01c9e0b49a6fee09b562fc1aee1c65cf9a17648f718f",
    "kiro-power/mcp.json": "9fc1ce60f5774b42ee805b390a43405536e51401e3e33a19dce204fe6c71497e",
    "mcp.json": "2b3827a30692ba8d188040e90f4d51bf10c0de900ab3889a7fe2fce4ee66ef0d",
    "mcp_config.json": "2b3827a30692ba8d188040e90f4d51bf10c0de900ab3889a7fe2fce4ee66ef0d",
    "plugin.json": "9cb2627036a4b8f288a6ef5c048cbc06c84c4536ebe5db76a30b8c17d8c88a04",
    "rules/sonarqube.md": "39d56e55a066ffaa153e71f777dbaf3995035e933651dd1491007c060ee1336f",
    "scripts/setup.js": "b96ca90e1ee30db9b629224418c9345abe5a56f1496f026dcca321a641bd49d0",
    "skills/sonar-analyze/SKILL.md": "575142711c38ff1d50b2b74c5de9a1be19cb050bd58c0a562716ac2779e0c87b",
    "skills/sonar-coverage/SKILL.md": "cffca8cab282592be0c786566e7ca9828d5fa3d68e658717a9734591a58814a1",
    "skills/sonar-dependency-risks/SKILL.md": "15b26da2d3298f6739d262344eebe9e3a71e6b02d87573003ef4b74ab7f96a96",
    "skills/sonar-duplication/SKILL.md": "a73546e05609daf1d47068e2852590c7ae8527e454443c61dc25ffcc5dec46a3",
    "skills/sonar-fix-issue/SKILL.md": "6b57ea6a2b6348b53dc20c0bbe79e27e4fd8520d67c30f1139d919f285bced74",
    "skills/sonar-integrate/SKILL.md": "7054a0e5282cde06dcd8ba0f7fa944467183aa6f1422b446c2d81a8e5e60ad6d",
    "skills/sonar-list-issues/SKILL.md": "5dfc6cc08df66a4a0ca5f25c1f3b5a3e89266daca5acea33493341fedcd92a9e",
    "skills/sonar-list-projects/SKILL.md": "b13d7d8a62db78098d7a0577cee3952031ce791f496ce348436f5dd9de3685a3",
    "skills/sonar-quality-gate/SKILL.md": "a10642dbea25b0c4fa724581af91bf80e7b84d61f8db470e8ef99bda03e418df",
    "skills/sonar-triage-dependency-risks/SKILL.md": "8d5bb7d03e6edf7771794db781b04d0ba17c8b49519836ddb2b1df98dcd18d47"
  },
  "lockfiles": [
    "LOCK.json"
  ],
  "utc_date": "2026-10-19T18:07:27Z",
  "source_date": "2026-10-16",
  "discovered_date": "2026-10-16",
  "retested_date": "2026-10-19",
  "reviewed_date": "2026-10-19",
  "published_date": "2026-10-19",
  "modified_date": "2026-10-19",
  "reviewer": "machine pipeline",
  "harness_version": "toolwitness harness at commit 11dde7217ae6f8e4ac4d18a6380b18ba01450122",
  "claude_code_version": "Not applicable: static source inspection (commands.json).",
  "model_id": "Not applicable: static source inspection (commands.json).",
  "scanner_version": "Not applicable: static source inspection.",
  "rulepack_version": "Not applicable: static source inspection.",
  "agents": [],
  "disclaimer": "This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.",
  "commands": [
    "Ran 46 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."
  ],
  "prompt_list": [
    "Not applicable: static source inspection (commands.json)."
  ],
  "history": [
    "2026-10-19T18:07:27Z: pinned source inspection"
  ],
  "application": {
    "name": "sonarqube — 1 hook",
    "softwareVersion": "5a9356d957db063e4d2cf87511b44cc1ba88dc99",
    "applicationCategory": "DeveloperApplication",
    "operatingSystem": "Not exercised"
  },
  "artifacts": {
    "transcript": "Ran 46 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
    "sinkhole_log": "Not applicable: static source inspection (commands.json).",
    "canary_log": "Not applicable: static source inspection (commands.json).",
    "scanner_output": "Not applicable: static source inspection (commands.json).",
    "normalized_text": "{\n  \"listing\": {\n    \"skills\": [\n      {\n        \"path\": \"skills/sonar-analyze/SKILL.md\",\n        \"name\": \"sonar-analyze\",\n        \"description\": \"Analyze a file for quality and security issues using SonarQube\",\n        \"files\": {\n          \"skills/sonar-analyze/SKILL.md\": \"575142711c38ff1d50b2b74c5de9a1be19cb050bd58c0a562716ac2779e0c87b\"\n        }\n      },\n      {\n        \"path\": \"skills/sonar-coverage/SKILL.md\",\n        \"name\": \"sonar-coverage\",\n        \"description\": \"Find files with low test coverage and inspect uncovered lines in a SonarQube project (project key optional when MCP integration already defines the default project)\",\n        \"files\": {\n          \"skills/sonar-coverage/SKILL.md\": \"cffca8cab282592be0c786566e7ca9828d5fa3d68e658717a9734591a58814a1\"\n        }\n      },\n      {\n        \"path\": \"skills/sonar-dependency-risks/SKILL.md\",\n        \"name\": \"sonar-dependency-risks\",\n        \"description\": \"Search for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default project)\",\n        \"files\": {\n          \"skills/sonar-dependency-risks/SKILL.md\": \"15b26da2d3298f6739d262344eebe9e3a71e6b02d87573003ef4b74ab7f96a96\"\n        }\n      },\n      {\n        \"path\": \"skills/sonar-duplication/SKILL.md\",\n        \"name\": \"sonar-duplication\",\n        \"description\": \"Find files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key optional when MCP integration already defines the default project)\",\n        \"files\": {\n          \"skills/sonar-duplication/SKILL.md\": \"a73546e05609daf1d47068e2852590c7ae8527e454443c61dc25ffcc5dec46a3\"\n        }\n      },\n      {\n        \"path\": \"skills/sonar-fix-issue/SKILL.md\",\n        \"name\": \"sonar-fix-issue\",\n        \"description\": \"Fix a specific SonarQube issue in code by rule key and location\",\n        \"files\": {\n          \"skills/sonar-fix-issue/SKILL.md\": \"6b57ea6a2b6348b53dc20c0bbe79e27e4fd8520d67c30f1139d919f285bced74\"\n        }\n      },\n      {\n        \"path\": \"skills/sonar-integrate/SKILL.md\",\n        \"name\": \"sonar-integrate\",\n        \"description\": \"Installs sonarqube-cli if not already installed, authenticates, and integrates SonarQube with the current agent (installs analysis hooks & SonarQube MCP Server). Use when the user wants to set up SonarQube integration or asks to configure SonarQube.\",\n        \"files\": {\n          \"skills/sonar-integrate/SKILL.md\": \"7054a0e5282cde06dcd8ba0f7fa944467183aa6f1422b446c2d81a8e5e60ad6d\"\n        }\n      },\n      {\n        \"path\": \"skills/sonar-list-issues/SKILL.md\",\n        \"name\": \"sonar-list-issues\",\n        \"description\": \"Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties)\",\n        \"files\": {\n          \"skills/sonar-list-issues/SKILL.md\": \"5dfc6cc08df66a4a0ca5f25c1f3b5a3e89266daca5acea33493341fedcd92a9e\"\n        }\n      },\n      {\n        \"path\": \"skills/sonar-list-projects/SKILL.md\",\n        \"name\": \"sonar-list-projects\",\n        \"description\": \"List SonarQube projects accessible to the current user\",\n        \"files\": {\n          \"skills/sonar-list-projects/SKILL.md\": \"b13d7d8a62db78098d7a0577cee3952031ce791f496ce348436f5dd9de3685a3\"\n        }\n      },\n      {\n        \"path\": \"skills/sonar-quality-gate/SKILL.md\",\n        \"name\": \"sonar-quality-gate\",\n        \"description\": \"Show SonarQube quality gate status for a project — pass/fail and each condition (metric key, threshold, actual value), plus worst-offender breakdowns. Project key optional — resolved from `sonar-project.properties` or the MCP integration default.\",\n        \"files\": {\n          \"skills/sonar-quality-gate/SKILL.md\": \"a10642dbea25b0c4fa724581af91bf80e7b84d61f8db470e8ef99bda03e418df\"\n        }\n      },\n      {\n        \"path\": \"skills/sonar-triage-dependency-risks/SKILL.md\",\n        \"name\": \"sonar-triage-dependency-risks\",\n        \"description\": \"Triage SonarQube SCA dependency risks by CVE reachability, prepare safe UI writeups, and optionally bundle confirmed package fixes.\",\n        \"files\": {\n          \"skills/sonar-triage-dependency-risks/SKILL.md\": \"8d5bb7d03e6edf7771794db781b04d0ba17c8b49519836ddb2b1df98dcd18d47\"\n        }\n      }\n    ],\n    \"hooks\": [\n      {\n        \"path\": \"claude-hooks/hooks.json\",\n        \"sha256\": \"ca69a9b5a1f3f0b5bc07b29490743c66ce69ed022e0717700743cc2084946fdf\",\n        \"event\": \"SessionStart\",\n        \"matcher\": \"\",\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"node \\\"${CLAUDE_PLUGIN_ROOT}/scripts/setup.js\\\"\",\n          \"timeout\": 30\n        },\n        \"executed\": false\n      }\n    ],\n    \"executions\": []\n  }\n}"
  },
  "review_input": {
    "identity_artifact": "identity.json",
    "evidence_sha256": {
      "LOCK.json": "a7bfbe38ddfee634df40cbb4b17eb11df862eebac1024fec66511942fa74e61b",
      "commands.json": "d4bb485bf73bfac84bb1c3ebaebe0cee6365de45595720a784e1c23d4d8ce163",
      "complete.json": "91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f",
      "identity.json": "af089c258d5b51ff205492c92f29856eaf88de64abd2c89f2906270becadd294",
      "listing.json": "d6b89b7080a0ebfe5889eb33305f4aa6985f14fa2642f953be007924f4fa8262",
      "selection.json": "41766fd4a9c6175d70545cb5ea218f02b12fe89c6528308986313c43799abc62"
    },
    "claims": [
      {
        "id": "acquired",
        "field": "summary",
        "text": "Pinned source declarations and file hashes were listed.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "listed",
        "field": "outcome",
        "text": "Listed 1 hook declaration. Ran 46 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "tree",
        "field": "rule_results.0",
        "text": "The retained source tree matches its acquisition manifest.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "declared",
        "field": "rule_results.1",
        "text": "Declared hook names (listing.json): SessionStart",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      }
    ]
  },
  "review": {
    "kind": "machine-checked",
    "date": "2026-10-19",
    "reviewed_sha256": "de9bf5c9b96bc807b1df111f93f0553d4818c3a01b92950260a5a2bf266474b0",
    "gates": "4169943a4d87b04888b780e5f5bb999ab40efed51603216259305c572540d8a4",
    "codex": "7ddf6a5af40e8180ecf4066f2255b007bdc00601d80745c7cf78d301b1002b35",
    "grok": "d9d70696aec3d7394bbc12bcc2af3bd6a4414b2b4d2861b5db3355c94b56ace3",
    "summary": "Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."
  }
}