[ShivamSharma43]

Summary

SonarQube issue code block IDs depended on every code block extracted before them in the same subtask run.

ExtractIssues creates one sha256 hash and passes it to generateId for every code block (the issue's text range and each flow location). generateId wrote the code block's fields into it and took Sum, but Sum doesn't clear the state and the hash was never reset. So each ID was the hash of all code blocks so far, concatenated, and only the first code block of a run got the hash of its own fields. The same code block got a different ID whenever the raw rows before it changed, for example after a new SonarQube issue was collected. Details in #9389.

Changes:

• tasks/shared.go: generateId calls Reset() on the hash before writing, so the ID is the sha256 of the code block's own fields. The format string and the hash function are unchanged.
• tasks/shared_test.go: TestGenerateIdWithReusedHash reuses one hash the way the extractor does. It checks that the second code block gets the same ID as in TestGenerateId, and that generating the first code block again gives its original ID. It fails without the fix.
• e2e/snapshot_tables/_tool_sonarqube_issue_code_blocks.csv and issue_code_blocks.csv: new code block IDs. To get them, I first replayed the raw fixture with a running hash, which reproduced all 165 old IDs exactly. Then I replaced each ID with the sha256 of that code block's own fields. 163 IDs change; the first code block of each connection keeps its ID. The new IDs are all unique, and no other columns change. Rows are kept sorted by ID.

After upgrading, the next extraction writes code blocks with the new IDs. The extractor deletes the previous rows for the same raw params first, so old IDs don't stay behind.

Does this close any open issues?

Fixes #9389

Screenshots

N/A

Other Information

• go test ./plugins/sonarqube/tasks/: pass.
• go vet ./plugins/sonarqube/tasks/ ./plugins/sonarqube/e2e/, gofmt and golangci-lint run ./plugins/sonarqube/...: clean. I didn't run the sonarqube e2e tests locally (they need E2E_DB_URL), so the snapshot IDs were computed as described above rather than produced by the test run.
• No open PR or issue touches the SonarQube issue extractor.
• Suggested label: pr-type/bug-fix.
• AI assistance disclosure: this change was prepared with the help of Claude Code (Claude Opus 5.5), and I reviewed the diff. The commit carries a Generated-by: trailer per the ASF generative tooling guidance.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.