# Sonarqube Refactoring

> A Claude skill from shikanime-labs/skills.

- **Type:** Skill
- **Install:** `agentstack add skill-shikanime-labs-skills-sonarqube-refactoring`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [shikanime-labs](https://agentstack.voostack.com/s/shikanime-labs)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [shikanime-labs](https://github.com/shikanime-labs)
- **Source:** https://github.com/shikanime-labs/skills/tree/main/skills/hermes/sonarqube-refactoring

## Install

```sh
agentstack add skill-shikanime-labs-skills-sonarqube-refactoring
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# SonarQube Refactoring

Fix code quality issues flagged by SonarQube analysis, especially for PR quality
gates.

## Common Issue Patterns & Fixes

### 1. Cognitive Complexity (S3776 — limit 15)

When a function exceeds 15 cognitive complexity, extract helper methods:

**Before:** One large method with nested `if`, `for`, `&&`, `||` **After:**
Extract 1-2 private methods per logical grouping

**Extraction targets:**

- Field-by-field update building → `applyXUpdates(tx, id, data)`
- Validation chains with early returns → `validateX(data, context)`
- Nested loops with conditionals → `buildXMap(data)`

**Target:** Reduce to ≤15. Aim for 2-3 points below threshold to leave headroom.

### 2. Unnecessary Type Assertions (S1905, S4325)

SonarQube flags `as X` when the assertion doesn't change the type.

**Pattern:** `getRequest() as { project?: ProjectContext }` where the return
type already includes the shape. **Fix:** Remove the `as` assertion entirely.

**Pattern:** `return projects as Project[]` where the function already declares
`Project[]` return type. **Fix:** Change the function signature to match the
actual data flow (accept/return `Partial` if that's what flows through), or
remove the assertion if the types already align.

### 3. typeof undefined Comparison (S1535)

**Before:** `typeof rest.locked !== 'undefined'` **After:**
`rest.locked !== undefined`

### 4. as any on delete Operations (S4325)

**Before:**

```typescript
const effectiveData = { ...data }
delete (effectiveData as any).locked
if (project.locked && (effectiveData as any).locked !== false) { ... }
```

**After:**

```typescript
const effectiveData: Record = { ...data }
delete effectiveData.locked
if (project.locked && effectiveData.locked !== false) { ... }
```

Using `Record` makes `delete` and property access type-safe
without `as any`.

### 5. Duplicate Imports (S1128)

**Before:**

```typescript
import type { Prisma } from "@prisma/client";
import type { Project, ProjectMembers, User } from "@prisma/client";
```

**After:**

```typescript
import type { Prisma, Project, ProjectMembers, User } from "@prisma/client";
```

### 6. Replace if/else Chains with Zod (S3776 contributor)

When a function has 4+ `if/else if` branches doing type-based value conversion:

**Before:**

```typescript
function secretValueToString(value: unknown): string {
  if (typeof value === "string") return value;
  if (
    typeof value === "number" ||
    typeof value === "bigint" ||
    typeof value === "boolean"
  )
    return String(value);
  if (value === null || value === undefined) return "";
  return JSON.stringify(value);
}
```

**After:**

```typescript
const SecretValueSchema = z
  .union([
    z.string(),
    z.undefined().transform(() => ""),
    z.number().transform((v) => String(v)),
    z.bigint().transform((v) => String(v)),
    z.boolean().transform((v) => String(v)),
    z.null().transform(() => ""),
  ])
  .catch("");

// Usage:
groupObj[key] = SecretValueSchema.parse(value);
```

### 7. Replace Custom Concurrency Helpers with Promise.allSettled

**Before:** Custom `runWithConcurrency(tasks, limit)` with `Set`,
`Promise.race`, manual tracking. **After:**
`Promise.allSettled(tasks.map(t => t()))` — simpler, standard, sufficient for
most cases.

## Procedure

1. **Read the SonarQube annotation list** — each issue has a rule ID and line
   number
2. **Group by type** — fix all instances of the same pattern together
3. **Fix simplest first** — `typeof` comparisons, duplicate imports, unnecessary
   `as`
4. **Then structural** — cognitive complexity via extraction, Zod replacement
5. **Run `tsc --noEmit`** after each group to verify no new type errors
6. **Run tests** — `pnpm test -- --run ` to verify behavior
   preserved

## Pitfalls

- **Extracting methods changes `this` context** — use arrow functions or
  `.bind(this)` when passing extracted methods as callbacks
- **`Record` needs casts for Prisma** — when passing values
  from `Record` to Prisma calls, cast at the boundary:
  `effectiveData.ownerId as string`
- **Zod `.catch('')` handles the fallback** — make sure the catch value matches
  the expected empty state for your domain
- **After extracting methods, update call sites** — the extracted method
  parameters must match what's available in the calling context

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [shikanime-labs](https://github.com/shikanime-labs)
- **Source:** [shikanime-labs/skills](https://github.com/shikanime-labs/skills)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-shikanime-labs-skills-sonarqube-refactoring
- Seller: https://agentstack.voostack.com/s/shikanime-labs
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.