Issues, Statuses, Assignments, False Positives, and Resolution Workflow: Guided Hands-On Workflow

1. Lab boundary and preflight

Use the local Community Build instance from earlier chapters at http://localhost:9000. The project and source must be disposable and synthetic.

2. Create a mixed issue fixture and commit the baseline

The fixture intentionally contains simple maintainability problems. Analyzer rules evolve, so the lab records the current observed rule keys/count instead of hard-coding a guaranteed number.

mkdir issue-workflow-lab
cd issue-workflow-lab
git init
git config user.name "Academy Lab Author"
git config user.email "academy-lab@example.invalid"
cat > app.py <<'PYFIX'
def total(values):
    unused_message = "temporary diagnostic message"
    result = 0
    for value in values:
        result += value
    return result

def choose_rate(vip, region, seasonal, partner):
    if vip:
        if region == "north":
            if seasonal:
                if partner:
                    return 0.55
    return 0.10
PYFIX
cat > sonar-project.properties <<'PROPS'
sonar.projectKey=academy_issue_workflow_lab
sonar.projectName=Academy Issue Workflow Lab
sonar.sources=.
sonar.exclusions=.git/**,.scannerwork/**
PROPS
git add app.py sonar-project.properties
git commit -m "baseline issue workflow fixture"
git rev-parse HEAD

3. Run baseline analysis and preserve task evidence

export SONAR_HOST_URL="http://localhost:9000"
# SONAR_TOKEN is a project analysis token for this disposable project.
sonar-scanner -X 2>&1 | tee baseline-scanner.log
git rev-parse HEAD > baseline-revision.txt
cp .scannerwork/report-task.txt baseline-report-task.txt

Preserve ceTaskId from baseline-report-task.txt and wait for that Compute Engine task. Only then inventory Open issues with rule, location, message, assignee/author, and rule context. If the current analyzer raises fewer issues than expected, add another obvious synthetic problem and commit it; do not weaken the profile just to manufacture counts.

4. Triage and assign without changing code

Classify observed findings into fix now, valid but deferred, or possible analyzer mistake requiring investigation. Assign the fix-now item to the lab user and add a comment such as LAB: ownership assigned after baseline triage; source unchanged.

Verify that the Activity history changed while git rev-parse HEAD did not. This is direct evidence that assignment/comment state is separate from analysis/source state.

5. Fix one observed issue and reanalyze

Use the example below only if the baseline actually reports the unused variable. Otherwise repair another simple observed issue and record the exact rule/location.

# Only use this exact edit when the observed issue is the unused variable.
python - <<'PYEDIT'
from pathlib import Path
p = Path("app.py")
t = p.read_text()
t = t.replace('    unused_message = "temporary diagnostic message"\n', '')
p.write_text(t)
PYEDIT
git diff -- app.py
git add app.py
git commit -m "fix one observed SonarQube issue"
git rev-parse HEAD > fixed-revision.txt
sonar-scanner -X 2>&1 | tee fixed-scanner.log
cp .scannerwork/report-task.txt fixed-report-task.txt

Wait for the new task. A source-fix claim is supported only when the new revision is processed successfully and the original issue is no longer detected, causing SonarQube to set it Fixed. If it remains Open, diagnose revision/indexing/rule evidence rather than manually changing status.

6. Exercise one justified temporary Accepted action

Choose a remaining valid low-risk lab finding and set it to Accepted with a comment containing: lab-only purpose, owner, recorded SHA, and “reopen before cleanup.” Capture the unchanged Git SHA, Activity entry, issue measures, and gate before/after.

If the gate does not change, explain which conditions were unaffected. If it changes, explicitly state that workflow metadata—not a code fix—caused that effect.

7. Optional read-only API evidence

The UI Activity tab is sufficient for the mandatory path. For machine-readable evidence, a short-lived User token may be used because Web API bearer authentication requires a user-capable token; it inherits that user’s permissions and is broader than a project analysis token.

# Optional read-only machine evidence. Never echo the token.
export SONAR_API_TOKEN="<short-lived-user-token>"
curl --fail --silent --show-error   -H "Authorization: Bearer ${SONAR_API_TOKEN}"   "${SONAR_HOST_URL}/api/issues/search?componentKeys=academy_issue_workflow_lab&ps=100"   > issues-after-triage.json
# Revoke SONAR_API_TOKEN immediately after capture.

Web API V2 is gradually replacing older endpoints. Keep write mutations in the UI for this chapter; before automating a mutation, inspect the current instance’s built-in API docs and revalidate the method/path.

8. Reopen and clean up without erasing evidence

1. Reopen the temporary Accepted issue and verify it returns to Open.
2. Revoke any optional User token and verify it no longer authenticates.
3. Revoke the project analysis token unless the next lab needs it.
4. Preserve evidence outside the disposable repository.
5. Delete only the uniquely named lab project if full cleanup is intended; never delete a real project to erase history.

9. Mini challenge: name the owning layer

• Issue remains Open after editing a different file → inspect revision/indexing/location, not status.
• Gate turns green after Accepted with unchanged SHA → workflow/policy effect, not source repair.
• Last committer is assigned but another team owns remediation → reassign; do not rewrite history.
• One rule looks wrong across dozens of files → investigate rule/profile/scope before mass False positive.

Knowledge check

Official references and version notes

• Issues introduction — current issue concepts and lifecycle entry points.
• Issue management solution — identification, SCM-assisted assignment and lifecycle.
• Editing issues — Accepted/False positive, reopening, assignment, tags, comments and bulk changes.
• Retrieving issues — current issue filtering and review UI.
• Web API — bearer authentication and Web API V2 migration guidance.
• Managing tokens — token types, API use and revocation.
• SonarQube releases — dated release identities.
• SonarScanner CLI 8.1.0.6389 — scanner baseline.