java:S1144: renaming an annotation type changes whether an unused private method is reported

Rules and Languages Report False-positive / False-negative...
1

Product/version: SonarQube Community Build 26.9.0.129388 (sonar-java 8.41.0.47177), sonar-scanner 8.1.0.6389

Language: Java

Rule: java:S1144

Issue:

The two files only differ in the name of a user annotation type: @interface MethodTag { String value(); } vs @interface Lookup, used as @MethodTag("helper") / @Lookup("helper") on a public method, plus an unused private void helper(). With MethodTag S1144 is silent, with Lookup it reports helper(). Nothing references helper() in either file.

UnusedPrivateMethodCheck.MethodsUsedInAnnotationsFilter treats a string literal as a method reference when the annotation’s simple name contains “method” (case-insensitive; SONARJAVA-4943, PR #4776). If that’s meant for JUnit’s @MethodSource and similar, could it be limited to those, or mentioned in the rule description?

Reproducer:

seed/WRRename.java:

import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;

public class WRRename {
    @Retention(RetentionPolicy.RUNTIME)
    @interface MethodTag {
        String value();
    }

    @MethodTag("helper")
    public void run() {
        helper(1);
    }

    public void helper(int x) {
        System.out.println(x);
    }

    private void helper() {
        System.out.println("h");
    }
}

variant/WRRename.java:

import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;

public class WRRename {
    @Retention(RetentionPolicy.RUNTIME)
    @interface Lookup {
        String value();
    }

    @Lookup("helper")
    public void run() {
        helper(1);
    }

    public void helper(int x) {
        System.out.println(x);
    }

    private void helper() {
        System.out.println("h");
    }
}

Expected behavior:

The same result on both files: S1144 on helper() in both, or an exemption stated in the rule description.

How to reproduce:

# one project per file
sonar-scanner -Dsonar.projectKey=<key> -Dsonar.sources=. \
    -Dsonar.java.binaries=. -Dsonar.scm.disabled=true

Output of the commands above:

### SonarQube Community Build 26.9.0.129388 (sonar-java 8.41.0.47177), server reports 26.9.0.129388, default Sonar way profile  rule: S1144

--- SEED -- expected: not reported (seed/)
    java:S1220             line -    Move this file to a named package.
    java:S106              line 16   Replace this use of System.out by a logger.
    java:S106              line 20   Replace this use of System.out by a logger.
    [S1144: 0]

--- VARIANT -- expected: not reported; actual: reported (variant/)
    java:S1220             line -    Move this file to a named package.
    java:S106              line 16   Replace this use of System.out by a logger.
    java:S1144             line 19   Remove this unused private "helper" method.  <== S1144
    java:S106              line 20   Replace this use of System.out by a logger.
    [S1144: 1]