CPP-7789 Add shared SonarResolve parser to analyzer commons

[mostafa-mohammed-sonarsource]

This PR moves the SonarResolve parser to sonar-analyzer-commons so it can be reused by other analyzers.

The initial implementation was released in CFamily 6.79. The main reason for moving it here is that we now need to improve and share the parsing logic, especially around code-formatting cases that can split or otherwise alter comments across multiple lines and break sonar-resolve directives.

This PR adds the shared parser and its tests to analyzer commons so follow-up fixes and enhancements can be implemented once and consumed from a common place. It is consumed in https://github.com/SonarSource/sonar-cpp/pull/6115.

[mostafa-mohammed-sonarsource]

This change is part of the following stack:

• CPP-7789 Add shared SonarResolve parser to analyzer commons #387 ◀
  • CPP-7901 Make SonarResolve parser case-insensitive #388
    • CPP-7902 Support multiple justification delimiters in SonarResolve #389

_{Change managed by git-spice.}

[hashicorp-vault-sonar-prod]

CPP-7789

[sonar-review-alpha]

Summary

This PR moves the SonarResolve directive parser into shared analyzer commons so other SonarSource analyzers can reuse it. The parser handles multi-line sonar-resolve comments in source code, which is needed because code formatters can split directives across multiple comment lines.

The implementation adds:

• SonarResolve.java (~437 lines): A data class with nested StreamingParser for parsing directives incrementally, supporting case-insensitive keywords, multiple justification delimiters, escape sequences, and explicit error messages
• SonarResolveTest.java (~358 lines): Comprehensive parametrized tests for single-line, multi-line, and error cases
• Updated pom.xml files: JAR size thresholds and Sonar plugin API version

What reviewers should know

Start reading: The core implementation is in SonarResolve.java. The architecture has three levels:

1. SonarResolve data class (lines 47-115): Simple immutable value object with constructor, accessors, equals/hashCode, toString
2. StreamingParser (lines 117-187): Public API that accumulates lines and tracks parsing state (INCOMPLETE/COMPLETE/INVALID)
3. Parser inner class (lines 189-456): Does the actual parsing, with a Cursor helper (lines 384-451) for text navigation

Key design decisions:

• Streaming design: The StreamingParser.consumeLine() method deliberately doesn't close over newlines (lines 170-175 append with \n). This lets code formatters split directives across multiple comment lines naturally.
• Case-insensitivity: expectLiteralIgnoreCase() at line 401 uses String.regionMatches(true, ...) so "SONAR-RESOLVE", "sonar-resolve", and mixed case all work.
• Flexible delimiters (lines 365-382): Supports quotes, single quotes, backticks, and bracket pairs for justification to handle various comment styles.
• Error recovery: Parser tracks detailed error messages (e.g., "unterminated status", "duplicate rule key") to help users fix invalid directives.

Testing coverage: Test file uses parametrized tests with @MethodSource streaming test data, covering:

• Single-line success cases (16 variants with different delimiters, escapes, etc.)
• Single-line failures (15 invalid syntax patterns)
• Multi-line success cases (8 variants with breaks at different positions)
• Multi-line failures (6 error conditions)
• Edge cases like empty continuation lines inside justification (line 576-585)

Worth reviewing: The escape sequence handling (lines 334-345) and the multi-line accumulation logic—these are the areas most likely to interact with real formatter edge cases.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[lijun-chen-sonarsource]

Thanks for working on this. I personally very much like sonar-resolve as feature, so looking forward to see everything merged and released.

I left some comments. Curious to hear what you think.

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
1 Accepted issue

Measures
0 Security Hotspots
4 Dependency risks
93.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[sonar-review-alpha]

LGTM! ✅

🗣️ Give feedback

[lijun-chen-sonarsource]

LGTM!