We made a bot, built on an [open source framework](<a href="https://codemodder.io" rel="nofollow">https://codemodder.io</a>), that fixes the problems Sonar (and others!) find in your code. Here are a handful of examples of pixeebot fixing Sonar findings on some OSS code:<p><a href="https://github.com/nahsra/cql-evaluator-fork/pull/1/files">https://github.com/nahsra/cql-evaluator-fork/pull/1/files</a>
<a href="https://github.com/nahsra/bsights-engine-spark-fork/pull/1/files">https://github.com/nahsra/bsights-engine-spark-fork/pull/1/f...</a>
<a href="https://github.com/pixee/pygoat/pull/2/files">https://github.com/pixee/pygoat/pull/2/files</a><p>The changes aren't all super fancy, but we're orienting towards solving real problems and remediating issues -- grunt work you don't want to have to do, but compliance says you should (and you probably should)!<p>Right now, we fix around 25 of the things that Sonar commonly finds (and a lot more that it doesn't find!). You can see the complete list of things we fix here:<p><a href="https://docs.pixee.ai/codemods/overview/" rel="nofollow">https://docs.pixee.ai/codemods/overview/</a><p>I'll tell you, it's so much nicer to receive PRs than tool warnings.<p>To try it out:<p>1. Install the Pixeebot GitHub App on a Sonar-monitored GitHub repository<p><pre><code> - https://github.com/apps/pixeebot
</code></pre>
2. Create a Sonar token that Pixeebot can use to read your findings
- For SonarCloud users: go here <a href="https://sonarcloud.io/account/security" rel="nofollow">https://sonarcloud.io/account/security</a>
- For other Sonar users, go to User > My Account > Security
- Put that token in a SONAR_TOKEN repository secret<p>3. Add the GitHub Action that will connect Pixeebot to Sonar<p>- Copy this sample action into your repo: <a href="https://github.com/pixee/upload-tool-results-action/blob/main/examples/sonar-pixeebot.yml">https://github.com/pixee/upload-tool-results-action/blob/mai...</a>
- Set the Sonar URL if you're using a locally hosted SonarQube<p>Boom! Now, pixeebot will monitor your repository and thoughtfully send you PRs at the right moments. Like, when Sonar finds some issues in your new PR, or when we think there's a good opportunity to address something in your backlog.<p>We've got so much more in the pipeline I'd love to tell you about, but we're eager to get feedback on what we've got so far for Sonar users.<p>P.S. By the way, we're a small team but we offer all the right security and compliance controls a company might want: <a href="https://trust.pixee.ai/" rel="nofollow">https://trust.pixee.ai/</a>.