AutoCodeRover: Agentic Program Repair for SonarQube Issues

Abstract

Agentic systems have been gaining traction in solving software engineering tasks. These tasks span from writing documentation, fixing faults in the codebase, and developing new features. A promising application of LLM agents is addressing software "issues", with an issue capturing a unit of improvement needed in a software project. Issues can be detected and constructed by static analysis tools, such as SonarQube. Static analysis tools frequently generate a substantial number of reports related to security vulnerabilities and code quality, imposing a significant manual workload on developers. With the advances in agentic AI, there is potential to automatically remediate these issues, thereby reducing developer effort. In this paper, we present our experience and lessons learned in adapting the AutoCodeRover program improvement agent to automatically propose patches for issues reported by SonarQube. We name this new agent SonarQube Remediation Agent, specialized for fixing SonarQube issues. SonarQube Remediation Agent is designed to be capable of interacting with mission-critical codebases in a secure and trustworthy manner. We discuss our approach in tackling practical challenges such as handling large volumes of issues and designing seamless user interactions. SonarQube Remediation Agent is integrated into the software development lifecycle by suggesting patches during the pull request review workflow, enabling developers to efficiently improve software quality and security with SonarQube.