feat(python): add uv path settings and bump java client (TC-3860) by a-oren · Pull Request #257 · redhat-developer/intellij-dependency-analytics

a-oren · 2026-04-27T12:23:13Z

Summary

Add uv executable path setting to the settings UI with TRUSTIFY_DA_UV_PATH system property propagation
Bump trustify-da-java-client from 0.0.15 to 0.0.17-SNAPSHOT for pip report-based pyproject.toml support and uv provider
Bump trustify-da-api-spec from 2.0.2 to 2.0.7 to match java client dependency

Test plan

Settings → Dependency Analytics → verify "uv > Executable: Path" field exists with file browser
Set uv path → apply → verify TRUSTIFY_DA_UV_PATH system property is set
Open pyproject.toml with uv.lock present → verify uv provider is used
Open pyproject.toml without uv.lock → verify pip fallback works
Open pyproject.toml with complex deps (extras, markers) → verify red lines appear
Verify existing requirements.txt functionality unchanged

🤖 Generated with Claude Code

a-oren · 2026-04-27T12:24:37Z

/review

qodo-code-review · 2026-04-27T12:24:43Z

Code Review by Qodo

🐞 Bugs (4) 📘 Rule violations (0)

1. Unresolvable SNAPSHOT dependency 🐞 Bug ☼ Reliability ⭐ New

Description

The build now depends on io.github.guacsec:trustify-da-java-client:0.0.17-SNAPSHOT, but the Gradle
repositories configuration does not include any snapshot repository, so dependency resolution will
fail on clean machines/CI (unless the artifact happens to be present in mavenLocal()).

Code

gradle/libs.versions.toml[R6-7]
+trustify-da-api-spec = "2.0.7"
+trustify-da-java-client = "0.0.17-SNAPSHOT"

Evidence

libs.versions.toml pins the client to a SNAPSHOT, and the build only declares mavenLocal(),
mavenCentral(), IntelliJ default repositories, and JitPack. With no snapshot repository
configured, Gradle will only be able to resolve the SNAPSHOT if it’s already installed in the local
Maven cache.

gradle/libs.versions.toml[6-7]
build.gradle.kts[24-31]
build.gradle.kts[63-67]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`trustify-da-java-client` is set to `0.0.17-SNAPSHOT`, but the build does not declare any snapshot repository, so the dependency will not resolve in CI/clean environments.

### Issue Context
The build currently uses `mavenLocal()`, `mavenCentral()`, IntelliJ default repositories, and JitPack. None of these are a general-purpose snapshot repository for `io.github.guacsec` artifacts.

### Fix Focus Areas
- gradle/libs.versions.toml[6-7]
- build.gradle.kts[24-31]

### Suggested fix
Do one of:
1) Prefer a released/non-SNAPSHOT version of `trustify-da-java-client`, OR
2) Add the appropriate snapshot repository hosting `io.github.guacsec` snapshots to `repositories { ... }` (ideally with `content { includeGroup("io.github.guacsec") }` to scope it).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. uvPath flags false modifications 🐞 Bug ≡ Correctness ⭐ New

Description

If settings.uvPath is null, reset() fills the UI field with an empty string but isModified()
compares "" to null, causing the settings page to appear modified even when the user didn’t
change anything.

Code

src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[60]
+        modified |= !Objects.equals(settingsComponent.getUvPathText(), settings.uvPath);

Evidence
reset() normalizes a null persisted value to "" in the UI, but isModified() directly compares
the UI text to the persisted value; Objects.equals("", null) is false, then negated to true, so
modified becomes true.
src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[47-61]
src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[146-160]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`uvPath` can make `isModified()` return true even after `reset()` when the stored value is `null`.

### Issue Context
- `reset()` sets the UI to `""` when `settings.uvPath` is null.
- `isModified()` compares UI text (`""`) to persisted value (`null`) and reports modified.

### Fix Focus Areas
- src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[47-61]
- src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[146-160]
- src/main/java/org/jboss/tools/intellij/settings/ApiSettingsState.java[50-56]

### Suggested fix
Pick one consistent representation:
- Treat empty as unset: in `apply()`, persist `null` when the text is blank, and in `isModified()` compare against `(settings.uvPath == null ? "" : settings.uvPath)`.
 OR
- Treat empty as default: initialize `uvPath` to `""` in `ApiSettingsState` (and/or normalize null to empty in `loadState`).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. uv setting always modified 🐞 Bug ≡ Correctness

Description

ApiSettingsConfigurable.isModified() compares the UI’s empty-string uv path against a null persisted
value, so the settings page will always be reported as modified for users who never had uvPath
saved. This can trigger unnecessary apply/save behavior and persist "" into settings just by
opening/closing settings.

Code

src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[60]
+        modified |= !Objects.equals(settingsComponent.getUvPathText(), settings.uvPath);

Evidence
reset() normalizes null uvPath to "" in the UI, but isModified() compares that "" directly to the
still-null settings.uvPath, which makes the uvPath comparison always evaluate as modified when the
stored value is null.
src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[47-77]
src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[145-176]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new uvPath setting is treated as modified when `ApiSettingsState.uvPath` is `null`, because `reset()` sets the UI to an empty string but `isModified()` compares the empty string to `null`.
### Issue Context
This leads to the settings UI being flagged as modified even when the user hasn’t changed anything, and can cause persisting `""` into settings unnecessarily.
### Fix Focus Areas
- src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[47-77]
- src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[145-176]
- src/main/java/org/jboss/tools/intellij/settings/ApiSettingsState.java[49-57]
### Suggested fix
Pick one consistent normalization strategy:
1) **Default the persisted value to empty string**: initialize `public String uvPath = "";` in `ApiSettingsState`.
and/or
2) **Normalize during comparison**:

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

4. SNAPSHOT client dependency 🐞 Bug ☼ Reliability

Description

The build is updated to depend on trustify-da-java-client 0.0.17-SNAPSHOT, which is mutable and can
change or disappear over time, making builds less reproducible. This increases the risk of CI/build
breakage unrelated to code changes if the snapshot is republished or removed.

Code

gradle/libs.versions.toml[7]
+trustify-da-java-client = "0.0.17-SNAPSHOT"

Evidence

The version catalog pins trustify-da-java-client to a SNAPSHOT version, which by definition is not
an immutable release artifact and can change between builds.

gradle/libs.versions.toml[1-10]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Depending on a `-SNAPSHOT` version makes builds non-reproducible and can cause unexpected build failures if the snapshot changes or becomes unavailable.
### Issue Context
The version catalog pins `trustify-da-java-client` to `0.0.17-SNAPSHOT`.
### Fix Focus Areas
- gradle/libs.versions.toml[1-10]
### Suggested fix
- Prefer a released, immutable version (e.g., `0.0.17` if available), or pin to a specific commit/build if snapshots are required.
- If you must use snapshots temporarily, consider adding explicit dependency locking/verification and a clear plan to revert to a release before publishing a stable plugin build.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-code-review · 2026-04-27T12:25:48Z

Review Summary by Qodo

Add uv path settings and bump java client dependencies

✨ Enhancement

Walkthroughs

Description

• Add uv executable path setting to settings UI with file browser
• Propagate uv path via TRUSTIFY_DA_UV_PATH system property
• Bump trustify-da-java-client to 0.0.17-SNAPSHOT for uv support
• Bump trustify-da-api-spec to 2.0.7 for compatibility

Diagram

flowchart LR
  A["Settings UI"] -->|"Add uv path field"| B["ApiSettingsComponent"]
  B -->|"Get/Set uv path"| C["ApiSettingsConfigurable"]
  C -->|"Persist uv path"| D["ApiSettingsState"]
  D -->|"Set system property"| E["ApiService"]
  E -->|"TRUSTIFY_DA_UV_PATH"| F["Java Client"]
  G["gradle/libs.versions.toml"] -->|"Bump versions"| F

File Changes

1. src/main/java/org/jboss/tools/intellij/exhort/ApiService.java ✨ Enhancement +5/-0

Propagate uv path system property
• Add logic to set TRUSTIFY_DA_UV_PATH system property from settings
• Clear property if uv path is null or blank
• Follows same pattern as existing pip path handling
src/main/java/org/jboss/tools/intellij/exhort/ApiService.java

2. src/main/java/org/jboss/tools/intellij/settings/ApiSettingsComponent.java ✨ Enhancement +21/-0

Add uv path UI component to settings

• Add uvPathLabel HTML label describing uv executable path setting
• Add uvPathText TextFieldWithBrowseButton UI component
• Initialize uv path field with file browser listener
• Add getter and setter methods for uv path text
• Integrate uv path field into settings panel layout

src/main/java/org/jboss/tools/intellij/settings/ApiSettingsComponent.java

3. src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java ✨ Enhancement +3/-0

Integrate uv path into settings lifecycle
• Add uv path comparison in isModified() method
• Add uv path assignment in apply() method
• Add uv path initialization in reset() method
• Maintain consistency with other executable path settings
src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java

View more (2)

4. src/main/java/org/jboss/tools/intellij/settings/ApiSettingsState.java ✨ Enhancement +1/-0

Add uv path to persistent settings state
• Add uvPath public string field to persistent state
• Enables storage and retrieval of uv executable path
src/main/java/org/jboss/tools/intellij/settings/ApiSettingsState.java

5. gradle/libs.versions.toml Dependencies +2/-2

Bump java client and api spec versions

• Bump trustify-da-api-spec from 2.0.2 to 2.0.7
• Bump trustify-da-java-client from 0.0.15 to 0.0.17-SNAPSHOT
• Provides pip report-based pyproject.toml support and uv provider

gradle/libs.versions.toml

qodo-code-review · 2026-04-27T12:25:49Z

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0)

1. uv setting always modified 🐞 Bug ≡ Correctness

Description

ApiSettingsConfigurable.isModified() compares the UI’s empty-string uv path against a null persisted
value, so the settings page will always be reported as modified for users who never had uvPath
saved. This can trigger unnecessary apply/save behavior and persist "" into settings just by
opening/closing settings.

Code

src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[60]
+        modified |= !Objects.equals(settingsComponent.getUvPathText(), settings.uvPath);

Evidence
reset() normalizes null uvPath to "" in the UI, but isModified() compares that "" directly to the
still-null settings.uvPath, which makes the uvPath comparison always evaluate as modified when the
stored value is null.
src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[47-77]
src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[145-176]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The new uvPath setting is treated as modified when `ApiSettingsState.uvPath` is `null`, because `reset()` sets the UI to an empty string but `isModified()` compares the empty string to `null`.

### Issue Context
This leads to the settings UI being flagged as modified even when the user hasn’t changed anything, and can cause persisting `""` into settings unnecessarily.

### Fix Focus Areas
- src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[47-77]
- src/main/java/org/jboss/tools/intellij/settings/ApiSettingsConfigurable.java[145-176]
- src/main/java/org/jboss/tools/intellij/settings/ApiSettingsState.java[49-57]

### Suggested fix
Pick one consistent normalization strategy:
1) **Default the persisted value to empty string**: initialize `public String uvPath = "";` in `ApiSettingsState`.

and/or
2) **Normalize during comparison**:
```java
modified |= !Objects.equals(settingsComponent.getUvPathText(),
   settings.uvPath != null ? settings.uvPath : "");
```

Optionally, avoid persisting empty strings by writing `null` on apply when blank:
```java
String uv = settingsComponent.getUvPathText();
settings.uvPath = (uv == null || uv.isBlank()) ? null : uv;
```

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. SNAPSHOT client dependency 🐞 Bug ☼ Reliability

Description

The build is updated to depend on trustify-da-java-client 0.0.17-SNAPSHOT, which is mutable and can
change or disappear over time, making builds less reproducible. This increases the risk of CI/build
breakage unrelated to code changes if the snapshot is republished or removed.

Code

gradle/libs.versions.toml[7]
+trustify-da-java-client = "0.0.17-SNAPSHOT"

Evidence

The version catalog pins trustify-da-java-client to a SNAPSHOT version, which by definition is not
an immutable release artifact and can change between builds.

gradle/libs.versions.toml[1-10]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Depending on a `-SNAPSHOT` version makes builds non-reproducible and can cause unexpected build failures if the snapshot changes or becomes unavailable.

### Issue Context
The version catalog pins `trustify-da-java-client` to `0.0.17-SNAPSHOT`.

### Fix Focus Areas
- gradle/libs.versions.toml[1-10]

### Suggested fix
- Prefer a released, immutable version (e.g., `0.0.17` if available), or pin to a specific commit/build if snapshots are required.
- If you must use snapshots temporarily, consider adding explicit dependency locking/verification and a clear plan to revert to a release before publishing a stable plugin build.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-code-review · 2026-04-27T12:27:31Z

+trustify-da-api-spec = "2.0.7"
+trustify-da-java-client = "0.0.17-SNAPSHOT"


1. Unresolvable snapshot dependency 🐞 Bug ☼ Reliability

The build now depends on io.github.guacsec:trustify-da-java-client:0.0.17-SNAPSHOT, but the Gradle repositories configuration does not include any snapshot repository, so dependency resolution will fail on clean machines/CI (unless the artifact happens to be present in mavenLocal()).

Agent Prompt

### Issue description `trustify-da-java-client` is set to `0.0.17-SNAPSHOT`, but the build does not declare any snapshot repository, so the dependency will not resolve in CI/clean environments. ### Issue Context The build currently uses `mavenLocal()`, `mavenCentral()`, IntelliJ default repositories, and JitPack. None of these are a general-purpose snapshot repository for `io.github.guacsec` artifacts. ### Fix Focus Areas - gradle/libs.versions.toml[6-7] - build.gradle.kts[24-31] ### Suggested fix Do one of: 1) Prefer a released/non-SNAPSHOT version of `trustify-da-java-client`, OR 2) Add the appropriate snapshot repository hosting `io.github.guacsec` snapshots to `repositories { ... }` (ideally with `content { includeGroup("io.github.guacsec") }` to scope it).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[sdlc-workflow/verify-pr] Classified as suggestion — the SNAPSHOT dependency is intentional for development; mavenLocal() is configured in build.gradle.kts and CI checks pass. For release, this will be updated to a released version. No sub-task created.

a-oren · 2026-04-27T12:35:24Z

Verification Report for TC-3860 (commit `47cd01e`)

Check	Result	Details
Review Feedback	PASS	1 bot comment (qodo-code-review) classified as suggestion — SNAPSHOT is intentional for dev
Root-Cause Investigation	N/A	No sub-tasks created
Scope Containment	WARN	`gradle/libs.versions.toml` out of scope (necessary for version bump). `ExcludeManifestIntentionAction.java` and `ManifestExclusionManagerSimpleTest.java` listed in task but missing — these were expected in upstream PR #244 but omitted
Diff Size	PASS	32 additions, 2 deletions, 5 files — proportional to scope
Commit Traceability	PASS	Commit references TC-3860
Sensitive Patterns	PASS	No matches
CI Status	PASS	All checks pass (SonarCloud, main)
Acceptance Criteria	WARN	5/6 criteria met on this PR. AC1 partially fails: `ExcludeManifestIntentionAction.java` missing `pyproject.toml` (was supposed to be in upstream PR #244 but wasn't)
Test Quality	WARN	`ManifestExclusionManagerSimpleTest.java` missing `pyproject.toml` in manifest array (upstream gap from PR #244)
Verification Commands	N/A	None specified

Acceptance Criteria Detail

Criterion	Result
pyproject.toml recognized in all code paths	WARN — present in 5/6 files; missing from `ExcludeManifestIntentionAction` (upstream PR #244 gap)
Settings UI includes uv path field	PASS
TRUSTIFY_DA_UV_PATH system property set	PASS
Stack analysis works with pyproject.toml	PASS
Component analysis works with pyproject.toml	PASS
Existing requirements.txt unchanged	PASS

Overall: WARN

Two gaps inherited from upstream PR #244 (not regressions in this PR):

ExcludeManifestIntentionAction.java missing pyproject.toml in isAvailable() check
ManifestExclusionManagerSimpleTest.java missing pyproject.toml in manifest array

These should be fixed in a follow-up commit on this branch or a separate PR.

This comment was AI-generated by sdlc-workflow/verify-pr v0.5.11.

ruromero

The docs have not been updated

Add uv executable path setting to the settings UI with TRUSTIFY_DA_UV_PATH system property propagation. Bump trustify-da-java-client to 0.0.17-SNAPSHOT and api-spec to 2.0.7 for pip report-based pyproject.toml support and uv provider. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document the new TRUSTIFY_DA_UV_PATH setting in the Python configuration section and system properties list. Update trustify-da-java-client from 0.0.17-SNAPSHOT to released 0.0.17. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sonarqubecloud · 2026-04-30T08:26:35Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

qodo-code-review Bot reviewed Apr 27, 2026

View reviewed changes

ruromero self-requested a review April 29, 2026 07:07

ruromero requested changes Apr 29, 2026

View reviewed changes

Comment thread gradle/libs.versions.toml Outdated

a-oren and others added 2 commits April 30, 2026 11:23

a-oren force-pushed the TC-3860 branch from 47cd01e to 3856501 Compare April 30, 2026 08:26

a-oren requested a review from ruromero April 30, 2026 08:38

ruromero approved these changes Apr 30, 2026

View reviewed changes

a-oren merged commit d540f85 into redhat-developer:main Apr 30, 2026
7 checks passed

a-oren deleted the TC-3860 branch April 30, 2026 09:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(python): add uv path settings and bump java client (TC-3860)#257

feat(python): add uv path settings and bump java client (TC-3860)#257
a-oren merged 2 commits into
redhat-developer:mainfrom
a-oren:TC-3860

a-oren commented Apr 27, 2026

Uh oh!

a-oren commented Apr 27, 2026

Uh oh!

qodo-code-review Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

qodo-code-review Bot commented Apr 27, 2026

Uh oh!

qodo-code-review Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

qodo-code-review Bot Apr 27, 2026

Uh oh!

a-oren Apr 27, 2026

Uh oh!

a-oren commented Apr 27, 2026

Uh oh!

ruromero left a comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Apr 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		trustify-da-api-spec = "2.0.7"
		trustify-da-java-client = "0.0.17-SNAPSHOT"

Uh oh!

Conversation

a-oren commented Apr 27, 2026

Summary

Test plan

Uh oh!

a-oren commented Apr 27, 2026

Uh oh!

qodo-code-review Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

qodo-code-review Bot commented Apr 27, 2026

Review Summary by Qodo

Walkthroughs

File Changes

Uh oh!

qodo-code-review Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

qodo-code-review Bot Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

a-oren Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

a-oren commented Apr 27, 2026

Verification Report for TC-3860 (commit 47cd01e)

Acceptance Criteria Detail

Overall: WARN

Uh oh!

ruromero left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Apr 30, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

qodo-code-review Bot commented Apr 27, 2026 •

edited

Loading

qodo-code-review Bot commented Apr 27, 2026 •

edited

Loading

Verification Report for TC-3860 (commit `47cd01e`)