Rspec github repository is gone/private?

gregc · February 6, 2026, 8:12am

Hi, I am not sure where else to post this. Anyway,https://github.com/SonarSource/rspec repository seems gone (or private i don’t know). Is this permanent ? Is there an official communication on this or maybe the rspec has been moved somewhere else?

Thanks, Greg.

ganncamp · February 6, 2026, 5:09pm

Hi Greg,

Welcome to the community!

Yes, we’ve made it private. I don’t have a lot of details for you. Official communication is in the works.

Ann

ganncamp · February 6, 2026, 5:48pm

Hi again,

Okay, here’s the official statement:

The SonarQube rules site is currently unavailable as is the RSPEC repo. SonarQube users are able to view rules within the SonarQube console. We recognize the rules site and rspec repository are a valuable resource and will provide additional updates as available.

HTH,
Ann

mfillon · July 29, 2026, 12:26pm

Hello,

Can we have some update on when (or if?) the rules site and rspec repo will be back?

Or is there an alternative?

I was using the public rules website, it’s very handy to share some rules description with someone without access to a SonarQube console or accross organizations (or you know in a public forum like this one).

One example, I’m using SonarQube for IDE and I’m not always on a project with a SonarQube server behind. Being able to share a link from IDE would be great.

Cheers, Matt

ganncamp · July 29, 2026, 2:33pm

Hi @mfillon,

There is no further update. The site was pulled to protect IP. It won’t be coming back.

The substitute is to use your org in SonarQube Cloud or your local instance of SonarQube as the reference.

Ann

karlhorky · September 19, 2026, 4:48pm

I ended up here after finding the downstream effects of making the RSPEC repository/site private.

The SonarSource/SonarJS repo still contains many public links to sonarsource.github.io/rspec, which now redirect users through GitHub authentication instead of showing the rule documentation:

github.com/SonarSource/SonarJS

packages/analysis/src/jsts/rules/README.md?plain=1

00ae65b77


      
          | [anchor-precedence](https://sonarsource.github.io/rspec/#/rspec/S5850/javascript)                                  | Alternatives in regular expressions should be grouped when used with anchors                                                   | ✅  |     |     | 💭  |     |
          | [argument-type](https://sonarsource.github.io/rspec/#/rspec/S3782/javascript)                                      | Arguments to built-in functions should match documented types                                                                  | ✅  |     |     | 💭  |     |
          | [arguments-order](https://sonarsource.github.io/rspec/#/rspec/S2234/javascript)                                    | Parameters should be passed in the correct order                                                                               | ✅  |     |     | 💭  |     |
          | [arguments-usage](https://sonarsource.github.io/rspec/#/rspec/S3513/javascript)                                    | "arguments" should not be accessed directly                                                                                    |     |     |     |     |     |
          | [array-callback-without-return](https://sonarsource.github.io/rspec/#/rspec/S3796/javascript)                      | Callbacks of array methods should have return statements                                                                       | ✅  |     |     | 💭  |     |
          | [array-constructor](https://sonarsource.github.io/rspec/#/rspec/S1528/javascript)                                  | Array constructors should not be used                                                                                          |     |     | 💡  |     |     |
          | [arrow-function-convention](https://sonarsource.github.io/rspec/#/rspec/S3524/javascript)                          | Braces and parentheses should be used consistently with arrow functions                                                        |     |     |     |     |     |
          | [assertions-in-test-cases](https://sonarsource.github.io/rspec/#/rspec/S8784/javascript)                           | Assertions should be placed inside test cases or hooks                                                                         | ✅  |     |     |     |     |
          | [assertions-in-tests](https://sonarsource.github.io/rspec/#/rspec/S2699/javascript)                                | Tests should include assertions                                                                                                | ✅  |     |     | 💭  |     |
          | [async-test-assertions](https://sonarsource.github.io/rspec/#/rspec/S8780/javascript)                              | Async test assertions should be awaited or returned                                                                            | ✅  |     |     |     |     |
          | [avoid-mutating-nested-properties-of-shallow-clones](https://sonarsource.github.io/rspec/#/rspec/S9135/javascript) | Nested properties of Lodash and Underscore.js clone results should not be mutated                                              | ✅  |     | 💡  |     |     |
          | [aws-apigateway-public-api](https://sonarsource.github.io/rspec/#/rspec/S6333/javascript)                          | AWS API Gateway should require authentication                                                                                  | ✅  |     |     |     |     |
          | [aws-ec2-rds-dms-public](https://sonarsource.github.io/rspec/#/rspec/S6329/javascript)                             | Public network access to cloud resources should be disabled                                                                    | ✅  |     |     |     |     |
          | [aws-ec2-unencrypted-ebs-volume](https://sonarsource.github.io/rspec/#/rspec/S6275/javascript)                     | EBS volumes should be encrypted                                                                                                | ✅  |     |     |     |     |
          | [aws-efs-unencrypted](https://sonarsource.github.io/rspec/#/rspec/S6332/javascript)                                | Amazon EFS file systems should be encrypted                                                                                    | ✅  |     |     |     |     |
          | [aws-iam-all-privileges](https://sonarsource.github.io/rspec/#/rspec/S6302/javascript)                             | Policies should not grant all privileges                                                                                       | ✅  |     |     |     |     |
          | [aws-iam-all-resources-accessible](https://sonarsource.github.io/rspec/#/rspec/S6304/javascript)                   | IAM policies should not grant access to all account resources                                                                  |     |     |     |     |     |
          | [aws-iam-privilege-escalation](https://sonarsource.github.io/rspec/#/rspec/S6317/javascript)                       | AWS IAM policies should limit the scope of permissions given                                                                   | ✅  |     |     |     |     |
          | [aws-iam-public-access](https://sonarsource.github.io/rspec/#/rspec/S6270/javascript)                              | AWS resource-based policies should not grant public access                                                                     | ✅  |     |     |     |     |
          | [aws-opensearchservice-domain](https://sonarsource.github.io/rspec/#/rspec/S6308/javascript)                       | OpenSearch domains should have encryption at rest enabled                                                                      | ✅  |     |     |     |     |

This file has been truncated. show original

github.com/SonarSource/SonarJS

tools/templates/ts/generated-meta.template

00ae65b77


      
          ___HEADER___// https://sonarsource.github.io/rspec/#/rspec/___RULE_KEY___/javascript
          
          // DO NOT EDIT! This file is autogenerated by "npm run generate-meta"
          
          import type {SonarMeta} from "../helpers/generate-meta.js";
          export * from './meta.js';
          
          export const meta = {
            type: '___RULE_TYPE___',
            docs: {
              description: '___DESCRIPTION___',
              recommended: ___RECOMMENDED___,
              url: 'https://sonarsource.github.io/rspec/#/rspec/___RULE_KEY___/javascript',

github.com/SonarSource/SonarJS

.github/actions/ruling_bot/action.yml

00ae65b77


      
              description: Path to the local sonar-lits sources checkout used for inline code snippets
              required: false
              default: its/sources
            sources-repo-url:
              description: Base URL of the remote sonar-lits sources repository used for file links in PR comments
              required: false
              default: ''
            rspec-base-url:
              description: Base URL used for RSPEC links in PR comments
              required: false
              default: https://sonarsource.github.io/rspec/#/rspec
            max-inline-snippets:
              description: Maximum number of inline snippets to embed before collapsing the remaining report
              required: false
              default: '10'
          
          runs:
            using: composite
            steps:
              - name: Run ruling bot
                shell: bash

I signed up for this Discourse to figure out what happened to these public docs.

I count 923 sonarsource.github.io/rspec occurrences across 626 committed files in SonarJS alone. GitHub code search also finds another 420 files referencing it outside SonarJS.

Eg. these links are now broken in PMD’s public rule documentation:

github.com/pmd/pmd

pmd-java/src/main/resources/category/java/bestpractices.xml

3bec06f12


      
                    externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_bestpractices.html#enumcomparison">
                  <description>
          When comparing enums, `equals()` should be avoided and `==` should be preferred.
          
          Using `==` has some advantages:
          * same semantic as `equals()`
          * less problematic with possible null pointer exceptions
          * supports static type check: If you compare two incompatible enum types, the compiler will tell you.
            When using equals, you'll only get noticed at runtime or not at all.
          
          This rule implements SonarSource rule [S4551](https://sonarsource.github.io/rspec/#/rspec/S4551).
          
          Note, that only primitive types and enums should be compared using `==`. To compare other
          objects, `equals()` is the correct way. See {%rule java/errorprone/CompareObjectsWithEquals %}
          and {%rule java/errorprone/UseEqualsToCompareStrings %}.
                  </description>
                  <priority>3</priority>
                  <properties>
                      <property name="xpath">
                          <value><![CDATA[
          //MethodCall[pmd-java:matchesSig("_#equals(java.lang.Object)")]

github.com/pmd/pmd

pmd-java/src/main/resources/category/java/codestyle.xml

3bec06f12


      
            language="java"
            since="7.17.0"
            message="Consider simply using the value vs. storing it in local variable ''{0}''."
            class="net.sourceforge.pmd.lang.java.rule.codestyle.VariableCanBeInlinedRule"
            externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_codestyle.html#variablecanbeinlined">
          <description>
              Local variables should not be declared and then immediately returned or thrown. Such
              variable declarations add unnecessary complexity and make the code harder to read.
              It is often simpler and cleaner to return or throw the value directly.
          
              This rule implements SonarSource rule [S1488](https://sonarsource.github.io/rspec/#/rspec/S1488).
          </description>
          <priority>3</priority>
          <example>
              <![CDATA[
                  class Foo {
                      Object foo() {
                          var foo = "foo";
                          return foo;  // instead, just 'return "foo";'
                      }

I understand from the update above that the full RSPEC repository/site isn’t coming back because of the IP protection.

G Ann Campbell, if you know anyone at SonarSource involved in this decision, could you ask them if such an option would be possible: Would it be possible to provide a public subset containing only the public docs intended for users?

Eg. one suggestion off the top of my head:

Keep the public-facing rule documentation as Markdown files directly in repositories such as SonarJS, similar to the rule docs that were previously maintained in eslint-plugin-sonarjs, and link to those files from the generated rules table, meta.docs.url, IDE integrations, etc.

This would avoid needing to maintain a separate documentation site, while allowing granular exposure of public docs without making the internal RSPEC content public again.

blelkes-ob · September 23, 2026, 9:33am

Do you consider the rule descriptions IP or only the code detection?

ganncamp · September 23, 2026, 12:17pm

Hi @blelkes-ob,

All of the above, apparently.

Honestly, I wasn’t part of the discussions around this. I can only tell you it was a strategic decision.

Ann

perlun · October 9, 2026, 5:42am

It’s even worse than the Rspec repo having gone private. I’ve noticed the SonarAnalyzer.CSharp .NET analyzer package has switched to a source-available license a couple of years ago, and is no longer Free Software/Open Source.

I’ve been using an outdated version of the package in my project and saw this now while working on upgrading. I’ll remove the SonarAnalyzer dependency.

Topic		Replies	Views
Https://rules.sonarsource.com down Rules and Languages rules	6	627	September 19, 2026
Rules.sonarsource.com not reachable anymore SonarQube Server / Community Build sonarqube	14	1713	September 19, 2026
Eslint-plugin-sonar Links to rule docs broken on GitHub page Rules and Languages github , eslint , documentation	3	182	September 19, 2026
Online reference rules.sonarsource.com is gone Rules and Languages	8	1029	February 12, 2026
Rules with specification (RSPEC) but not implemented yet... any way to know if the rule is going to be implemented? SonarQube Server / Community Build java , rules	2	1112	March 3, 2022

Rspec github repository is gone/private?

Related topics