SONARJAVA-6330: Implement S8692 - The system clock should not be used in tests

[aurelien-coet-sonarsource]

No description provided.

[sonar-review-alpha]

Summary

This PR implements rule S8692: "The system clock should not be used in unit tests." The implementation adds a static analysis check that detects non-deterministic temporal method calls within test code.

The check flags:

• .now() methods (Instant, LocalDate, LocalDateTime, etc.) called without parameters or with only a ZoneId
• System clock factory methods: Clock.systemUTC(), Clock.systemDefaultZone(), Clock.system(ZoneId)

Compliant alternatives like Clock.fixed() and mocked clocks are permitted. The rule is integrated into the Sonar way profile and includes comprehensive documentation explaining why system clocks cause flaky tests and how to fix them.

A baseline update indicates the rule produces 0 false positives and 0 false negatives on the eclipse-jetty corpus.

What reviewers should know

Start with:

• Rule logic: SystemClockCheck.java (60 lines) — uses MethodMatchers with two groups: temporal .now() methods and Clock system factory methods
• Test samples: SystemClockCheckSample.java — shows both noncompliant (direct system clock calls) and compliant patterns (fixed clocks, mocks)

Key design decisions:

• The check detects parametric .now(ZoneId) calls but allows .now(Clock) calls (which support injection)
• Both temporal types and Clock methods are matched to catch direct calls and service instantiation patterns
• Rules documentation (S8692.html) includes practical examples for token validation, leap years, and time zone handling

Integration notes:

• Autoscan baseline created with 0 false positives/negatives
• Eclipse-jetty corpus has 3 violations in DateCacheTest
• S3577 baseline affected (+1 false negative), likely an unrelated baseline drift
• Added to Sonar way profile in the default ruleset
• Commit message indicates prior review feedback was applied regarding .now(Clock) handling

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[tomasz-tylenda-sonarsource]

Let's keep the message generic, so it also covers reading the clock to measure elapsed time..

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[sonar-review-alpha]

LGTM! ✅

🗣️ Give feedback