fix(review): clear the Sonar findings and coverage gaps on the release diff (#427)

[devops-thiago]

What type of PR is this?

• 🔧 Refactor
• ✅ Test

Description

Clears everything #427 (release/v0.5.0 → main) reports. Opened against release/v0.5.0 rather
than pushed to it, so it flows into #427 through the normal path.

Sonar — 10 findings

java:S8786 super-linear regex ×2 (HeuristicCodeDetector) — the substantive ones.

• HEURISTIC_DECLARATION matched [^(=\r\n]* and then (\w+)\s*\(. The gap and the name class
  overlap, so on a long line with no ( the engine re-split at every position. The gap is now
  atomic and must end on a separator — it cannot consume the name, so there is nothing to backtrack
  into. A possessive quantifier would have been wrong here: it stops exactly the backtracking the
  name capture depends on.
• THRESHOLD_CONSTANT chained three unbounded runs ([^=]* … \w*(?:ALT)\w* … [^=]*=). Replaced by
  THRESHOLD_DECLARATION, one run terminated by =, with the name tokens checked in code — the
  same regex/code split HEURISTIC_NAME_STEMS already uses in this file.

java:S135 ×2 — the diff scan loop and ReviewPublisher.postInlineComments now branch with
if/else instead of stacked continues.

java:S107 — scheduleCaptureOnReviewReply had 8 parameters. It now takes the ReviewReply
record it already constructed internally from three of them, so the call site passes 6. The record
became public for the webhook caller.

java:S6126 ×5 — diff fixtures converted to text blocks.

Codecov — three files under threshold, now fully covered

All the gaps were in the #386 pure-rename support plus two error paths, and each new test pins real
behaviour rather than just touching the line:

• isPureRename with an absent file/status, and a rename reporting zero counts but carrying patch
  text — that one stays reviewable, so a rename+edit is never silently dropped from the budget
• the rollup's fallback when GitHub omits previous_filename (no arrow, just the new path)
• withPureRenames — both the identity return and the merge path, asserting renames append after
  reviewable files
• the summary overview leading with the rename rollup, which is what stops clamping from
  dropping the disclosure on large multi-call reviews
• unwrapParallelFailure preserving a real cause (the null-cause side was already covered)
• a bot root comment with no finding marker — capture stops before polling reactions

Related Issues

Fixes the failing codecov/patch and the Sonar findings on #427. No issue number — release cleanup.

How Has This Been Tested?

• Unit tests

• ./mvnw verify — 1863 tests, 0 failures, SpotBugs BugInstance size is 0, JaCoCo gate met

• JaCoCo confirms fully covered, 0 missed instructions/branches/lines for all five touched
  production files: HeuristicCodeDetector, ReviewDiffFormatter, FindingPipeline,
  FindingFeedbackCaptureService, ReviewPublisher

• The detector's 26-case suite is the guard on the two regex rewrites — behaviour is unchanged,
  including the parseInt exclusion and the test-path/window-constant detection those patterns drive

Checklist

• My code follows the project's coding standards
• I have performed a self-review of my own code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[thrillhousebot]

🤖 ThrillhouseBot PR Summary

What this PR does

Clears Sonar and Codecov findings on the release diff: rewrites two super-linear regex patterns in HeuristicCodeDetector, refactors a method with many parameters, converts diff fixtures to text blocks, and adds tests to lift coverage.

⚠️ Description vs. Implementation

The PR description does not fully match the change:

• Claims behavior unchanged, but the HEURISTIC_DECLARATION regex change introduces a logic error that will cause the detector to miss heuristic member declarations that involve a return type (e.g., private void foo()), which the old regex matched.
• The description asserts the 26-case detector suite guards the regex rewrites, but because the suite may not include such declarations the regression would go unnoticed.

Control-Flow Diagram

🔀 Show diagram

flowchart TD
    A[\"introducesHeuristicCode(diff)\"/] --> B[\"for each line\"/]
    B --> C{\"line starts with +++\"?}
    C -->|yes| D[\"scope = FileScope.of(line)\naddedLines.clear()\"/]
    C -->|no| E{\"scope.testFile() or\nline empty or not '+'\"?}
    E -->|yes| F[\"addedLines.clear()\"/]
    E -->|no| G[\"addedLines.addLast(line)\nif size > 4 removeFirst\"/]
    G --> H[\"isHeuristicLine(line) or isHeuristicWindow(addedLines)\"/]
    H -->|true| I[\"return true\"/]
    H -->|false| J[\"next line\"/]
    D --> J
    F --> J
    J --> B

Loading

Changes Overview

• Files changed: 11
• Lines added: +246
• Lines removed: -70

Changed Files

File	Change	Summary
src/main/java/dev/thiagogonzaga/thrillhousebot/review/FindingFeedbackCaptureService.java	Modified	Changed scheduleCaptureOnReviewReply signature to take ReviewReply record instead of three separate parameters; made ReviewReply public.
src/main/java/dev/thiagogonzaga/thrillhousebot/review/HeuristicCodeDetector.java	Modified	Replaced HEURISTIC_DECLARATION pattern with an atomic-group variant and THRESHOLD_CONSTANT with a new split pattern/code check; refactored loop to if/else.
src/main/java/dev/thiagogonzaga/thrillhousebot/review/ReviewPublisher.java	Modified	Refactored postInlineComments loop to use if/else instead of stacked continues.
src/main/java/dev/thiagogonzaga/thrillhousebot/webhook/WebhookController.java	Modified	Updated call to scheduleCaptureOnReviewReply to pass ReviewReply record.
src/test/java/dev/thiagogonzaga/thrillhousebot/review/FindingFeedbackCaptureServiceTest.java	Modified	Updated tests to use new ReviewReply parameter; added test for bot comment without finding marker.
src/test/java/dev/thiagogonzaga/thrillhousebot/review/FindingPipelineTest.java	Modified	Added tests for parallel failure cause unwrapping and summary overview leading with pure rename rollup.
src/test/java/dev/thiagogonzaga/thrillhousebot/review/HeuristicCodeDetectorTest.java	Modified	Converted diff string fixtures to text blocks for readability.
src/test/java/dev/thiagogonzaga/thrillhousebot/review/ReviewDiffFormatterTest.java	Modified	Added tests for pure rename edge cases (null files, zero counts, missing previous filename) and rollup behaviour.
src/test/java/dev/thiagogonzaga/thrillhousebot/review/ReviewOrchestratorTest.java	Modified	Updated test fixture to text block.
src/test/java/dev/thiagogonzaga/thrillhousebot/review/ReviewPromptAssemblerTest.java	Modified	-
src/test/java/dev/thiagogonzaga/thrillhousebot/webhook/WebhookControllerTest.java	Modified	Updated test to construct ReviewReply record for capture call.

Risk Assessment

Risk	Count
🔴 Critical	1
🟠 High	0
🟡 Medium	0
🔵 Low	0

Key Findings

• CRITICAL: HEURISTIC_DECLARATION regex fails to match any method declaration with a return type (src/main/java/dev/thiagogonzaga/thrillhousebot/review/HeuristicCodeDetector.java:100)

⚠️ CI Checks Status

Some checks are still pending or have failed:

Check	Type	Status	Detail
trivy	check-run	⏳ Pending	-
actionlint	check-run	⏳ Pending	-
format	check-run	⏳ Pending	-
changes	check-run	⏳ Pending	-
frontend	check-run	⏳ Pending	-
test	check-run	⏳ Pending	-
dependency-review	check-run	⏳ Pending	-

---

Automated review by ThrillhouseBot. Reply with /review to re-run.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Test image ready (native, amd64).

docker pull ghcr.io/devops-thiago/thrillhousebot:test-sha-ed00f4c-native
IMAGE_TAG=test-sha-ed00f4c-native docker compose up -d

Tags: ghcr.io/devops-thiago/thrillhousebot:test-sha-ed00f4c-native,ghcr.io/devops-thiago/thrillhousebot:test-pr-428-native

[devops-thiago]

/review

[thrillhousebot]

Everything's coming up Thrillhouse! 🎉

No issues found in this PR.

[devops-thiago]

/help

[thrillhousebot]

🤖 ThrillhouseBot commands

Command	What it does
/review	Run a fresh review of this PR
/summary	Post the PR summary if it isn't already on the PR (regenerates a deleted one)
/describe	Suggest an improved PR title and description from the diff
/changelog	Draft a CHANGELOG entry for this PR from the diff
/add-docs	Suggest docstrings for the symbols changed in this PR
/resolve	Resolve ThrillhouseBot's open finding threads on this PR
/pause	Silence the bot on this PR (no automatic or manual reviews)
/resume	Re-enable the bot on a paused PR
/help	Show this list

You can also use the mention form, e.g. @Thrillhousebot review. Every command except /help requires write access to the repository.

[devops-thiago]

/changelog

[devops-thiago]

/add-docs

[thrillhousebot]

📝 ThrillhouseBot found no changed symbols that need documentation in this PR.