CLI-526 Add a confirmation for the server selection

[Krosovok]

---

Summary by Gitar

• Security enhancement:
  • Added confirmServerTrust to prompt users to confirm server connection before authenticating.
  • Added security warning when connecting to non-SonarQube Cloud servers.
• Logic updates:
  • Integrated trust confirmation into both --server flag and interactive server selection flows.
  • Updated integration tests to simulate user input for the new trust confirmation prompt.

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

CLI-526

[sophio-japharidze-sonarsource]

We might need to test how this will look inside agent plugins that use integrate skill and are trying to set up connections themselves.

[Krosovok]

We might need to test how this will look inside agent plugins that use integrate skill and are trying to set up connections themselves.

Checked. The agent pre-filled the parameters and let the human run the command anyway.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Integrates trust confirmation for server connections into both CLI flags and interactive flows, successfully addressing the missing trust confirmation for config-discovered servers. No issues found.

✅ 1 resolved

✅ Security: Missing trust confirmation for config-discovered servers

📄 src/cli/commands/auth/login.ts:289-291
In resolveServer, the discoverServer() path (line 289-291) returns a server URL read from local config files (sonar-project.properties or .sonarlint) without calling confirmServerTrust(). This means a self-hosted SonarQube server discovered from configuration bypasses the trust prompt, while the same URL provided via --server flag or interactive input would trigger it.

This creates an inconsistency in the security model: a malicious or unexpected config file could silently connect the user to an untrusted server without confirmation.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}