feat(sonarqube-backend): fetch hotspot count, debt and language distribution

[rios0rios0]

Summary

Adds security_hotspots, sqale_index and ncloc_language_distribution to the fixed metric list getFindings requests from SonarQube.

Why

The list currently fetches security_hotspots_reviewed and sqale_rating — the percentage of hotspots reviewed and the maintainability grade. Neither carries the underlying figure, so a consumer cannot display:

wanted	currently fetched	actually needed
number of security hotspots	security_hotspots_reviewed (a %)	security_hotspots
technical debt as a duration	sqale_rating (an A–E grade)	sqale_index (minutes)
language breakdown	—	ncloc_language_distribution

There is no way to work around this outside the plugin: the metric list is fixed, and this backend holds the only SonarQube credential, so consumers read whatever getFindings returns and nothing else.

Concretely, a dashboard reading security_hotspots and sqale_index from the summary renders 0 for every project while SonarQube itself reports non-zero values for the same keys. I hit this building a dashboard on top of this plugin: across 181 projects it showed zero hotspots and zero debt, while 108 of them had code smells — which is the contradiction that led here.

Risk

Low, and the existing tests already demonstrate why. metricsToQuery intersects the wanted list with api/metrics/search, so an instance that does not support one of these simply omits it. The tests stub that endpoint with coverage, code_smells, vulnerabilities and unused_metric, so the three new keys are filtered out there and the existing metricKeys=vulnerabilities%2Ccode_smells%2Ccoverage assertions are unchanged.

Nothing that ignores the new keys is affected — this only widens what is available to consumers that ask for it.

Changeset

Included: minor on @backstage-community/plugin-sonarqube-backend, in workspaces/sonarqube/.changeset/.

[backstage-goalie]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage-community/plugin-sonarqube-backend	workspaces/sonarqube/plugins/sonarqube-backend	minor	v1.1.1

[Copilot]

Pull request overview

Extends the SonarQube backend plugin’s fixed metrics list used by getFindings so consumers can access underlying hotspot counts, technical debt duration, and language distribution directly from the backend-provided measures.

Changes:

• Add security_hotspots, sqale_index, and ncloc_language_distribution to the wantedMetrics list in getFindings.
• Add a changeset bumping @backstage-community/plugin-sonarqube-backend as minor documenting the new metrics.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
workspaces/sonarqube/plugins/sonarqube-backend/src/service/sonarqubeInfoProvider.ts	Expands the fixed metrics requested from SonarQube to include hotspot count, debt minutes, and language distribution.
workspaces/sonarqube/.changeset/plenty-donkeys-shave.md	Declares a minor release and documents the additional metrics now fetched.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.