SonarQube + OpenAI: Agentic Development — Killian Carlsen-Phelan, Sonar

This talk details the integration of SonarQube's static analysis capabilities with OpenAI's Codex agent to create an agentic development workflow focused on security and code quality. It demonstrates a 'guide, verify, and solve' loop where SonarQube findings are fed to an agent, which then proposes and implements fixes. Key contributions include: 1. **Feedback inside the agent loop:** Moving verification hooks directly into the coding loop to ensure immediate validation of changes. 2. **Secrets detection hook:** A mechanism to block fake credentials in prompts, enhancing agentic system security. 3. **Issue listing skill:** Providing agents with evidence from the project dashboard to inform their actions. 4. **Context augmentation:** Supplying coding guidance before generation. 5. **Agentic analysis:** Checking edits as they happen. The talk showcases fixing SQL injection vulnerabilities by replacing string interpolation with parameterized queries and verifies the fix. It also demonstrates adding new database operations within the same verification loop, highlighting the extensibility of the system for both fixing existing issues and checking new work. The discussion touches upon execution containment, artifact correctness, and the boundaries of hooks.