SONARJAVA-6423 Implement S8715 No JUnit 4 assertions in JUnit 5 tests

its/autoscan/src/test/resources/autoscan/diffs/diff_S8715.json

@@ -0,0 +1,6 @@
+{
+  "ruleKey": "S8715",
+  "hasTruePositives": false,
+  "falseNegatives": 165,
+  "falsePositives": 0
+}

java-checks-test-sources/default/src/test/java/checks/tests/Junit4AssertionsCheckSampleTest.java

@@ -0,0 +1,21 @@
+package checks.tests;
+
+import org.junit.jupiter.api.Test;
+
+class Junit4AssertionsCheckSampleTest {
+  @Test
+  void good() {
+    org.junit.jupiter.api.Assertions.assertEquals(2, 1 + 1);
+  }
+
+  @Test
+  void bad() {
+    org.junit.Assert.assertEquals(2, 1 + 1); // Noncompliant {{JUnit Jupiter tests should not use JUnit 4 assertions.}}
+//  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  }
+
+  @org.junit.Test
+  public void testOld() {
+    org.junit.Assert.assertEquals(2, 1 + 1); // compliant
+  }
+}

java-checks/src/main/java/org/sonar/java/checks/tests/JUnit4AssertionsCheck.java

@@ -0,0 +1,59 @@
+/*
+ * SonarQube Java
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+package org.sonar.java.checks.tests;
+
+import java.util.List;
+import org.sonar.check.Rule;
+import org.sonar.java.model.ExpressionUtils;
+import org.sonar.plugins.java.api.IssuableSubscriptionVisitor;
+import org.sonar.plugins.java.api.semantic.MethodMatchers;
+import org.sonar.plugins.java.api.tree.MethodInvocationTree;
+import org.sonar.plugins.java.api.tree.MethodTree;
+import org.sonar.plugins.java.api.tree.Tree;
+
+/**
+ * Check that JUnit Jupiter (JUnit 5) tests do not use JUnit 4 assertions.
+ */
+@Rule(key = "S8715")
+public class JUnit4AssertionsCheck extends IssuableSubscriptionVisitor {
+  private static final String MESSAGE = "JUnit Jupiter tests should not use JUnit 4 assertions.";
+
+  private static final String JUPITER_TEST_ANNOTATION = "org.junit.jupiter.api.Test";
+
+  private static final MethodMatchers JUNIT4_ASSERT = MethodMatchers.create()
+    .ofTypes("org.junit.Assert")
+    .anyName()
+    .withAnyParameters()
+    .build();
+
+  @Override
+  public List<Tree.Kind> nodesToVisit() {
+    return List.of(Tree.Kind.METHOD_INVOCATION);
+  }
+
+  @Override
+  public void visitNode(Tree tree) {
+    if (tree instanceof MethodInvocationTree mit && JUNIT4_ASSERT.matches(mit) && isInJupiterTest(mit)) {
+      reportIssue(mit.methodSelect(), MESSAGE);
+    }
+  }
+
+  private static boolean isInJupiterTest(MethodInvocationTree mit) {
+    MethodTree enclosingMethod = ExpressionUtils.getEnclosingMethod(mit);
+    return enclosingMethod != null && enclosingMethod.symbol().metadata().isAnnotatedWith(JUPITER_TEST_ANNOTATION);
+  }
+}

java-checks/src/test/java/org/sonar/java/checks/tests/JUnit4AssertionsCheckTest.java

@@ -0,0 +1,32 @@
+/*
+ * SonarQube Java
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+package org.sonar.java.checks.tests;
+
+import org.junit.jupiter.api.Test;
+import org.sonar.java.checks.verifier.CheckVerifier;
+
+import static org.sonar.java.checks.verifier.TestUtils.testCodeSourcesPath;
+
+class JUnit4AssertionsCheckTest {
+  @Test
+  void test() {
+    CheckVerifier.newVerifier()
+      .onFile(testCodeSourcesPath("checks/tests/JUnit4AssertionsCheckSampleTest.java"))
+      .withCheck(new JUnit4AssertionsCheck())
+      .verifyIssues();
+  }
+}

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S8715.html

@@ -0,0 +1,52 @@
+<h2>Why is this an issue?</h2>
+<p>This rule targets tests written with the JUnit Jupiter API (JUnit 5 and later), i.e. annotated with <code>org.junit.jupiter.api.Test</code>. While
+JUnit 4 assertions defined in <code>org.junit.Assert</code> continue to work in such tests, using them should be avoided.</p>
+<p>JUnit 5 ships with its own assertion library, <code>org.junit.jupiter.api.Assertions</code>, which is richer and consistent with the rest of the
+JUnit 5 API. Using JUnit 4 assertions in a JUnit 5 test is inconsistent. Because the two APIs differ in subtle ways, it can also lead to confusion and
+errors:</p>
+<ul>
+  <li>The position of the optional failure message argument is reversed. <code>org.junit.Assert</code> takes the message as the <strong>first</strong>
+  argument, <code>org.junit.jupiter.api.Assertions</code> as the <strong>last</strong>.</li>
+  <li>JUnit 5 overloads accept a <code>Supplier&lt;String&gt;</code>, so the failure message can be built lazily, which is not possible with JUnit
+  4.</li>
+</ul>
+<h2>How to fix it</h2>
+<p>Replace each call to a method of <code>org.junit.Assert</code> with the equivalent method of <code>org.junit.jupiter.api.Assertions</code>. If a
+failure message is provided, move it from the first to the last argument position.</p>
+<h3>Code examples</h3>
+<h4>Noncompliant code example</h4>
+<pre data-diff-id="1" data-diff-type="noncompliant">
+import org.junit.jupiter.api.Test;
+
+import static org.junit.Assert.assertEquals;
+
+class MyTest {
+  @Test
+  void shouldComputeAnswer() {
+    assertEquals("values should match", 42, compute()); // Noncompliant
+  }
+}
+</pre>
+<h4>Compliant solution</h4>
+<pre data-diff-id="1" data-diff-type="compliant">
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+class MyTest {
+  @Test
+  void shouldComputeAnswer() {
+    assertEquals(42, compute(), "values should match");
+  }
+}
+</pre>
+<h3>Going the extra mile</h3>
+<p>If you find the JUnit 5 assertion library limited, consider using a dedicated assertion library such as <a
+href="https://assertj.github.io/doc/">AssertJ</a> or <a href="https://hamcrest.org/JavaHamcrest/">Hamcrest</a>.</p>
+<h2>Resources</h2>
+<h3>Documentation</h3>
+<ul>
+  <li>JUnit 5 - <a href="https://docs.junit.org/6.1.0/writing-tests/assertions.html">Assertions</a></li>
+  <li>JUnit 5 - <a href="https://docs.junit.org/6.1.0/migrating-from-junit4.html#tips">Migration Tips</a></li>
+</ul>
+

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S8715.json

@@ -0,0 +1,24 @@
+{
+  "title": "JUnit Jupiter tests should not use JUnit 4 assertions",
+  "type": "CODE_SMELL",
+  "status": "ready",
+  "remediation": {
+    "func": "Constant\/Issue",
+    "constantCost": "5min"
+  },
+  "tags": [
+    "junit",
+    "tests"
+  ],
+  "defaultSeverity": "Minor",
+  "ruleSpecification": "RSPEC-8715",
+  "sqKey": "S8715",
+  "scope": "Tests",
+  "quickfix": "targeted",
+  "code": {
+    "impacts": {
+      "MAINTAINABILITY": "LOW"
+    },
+    "attribute": "CONVENTIONAL"
+  }
+}

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/Sonar_agentic_AI_profile.json

@@ -468,6 +468,7 @@
     "S8450",
     "S8465",
     "S8469",
-    "S8696"
+    "S8696",
+    "S8715"
   ]
 }

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/Sonar_way_profile.json

@@ -536,6 +536,7 @@
     "S8694",
     "S8695",
     "S8696",
-    "S8700"
+    "S8700",
+    "S8715"
   ]
 }

sonar-java-plugin/src/test/java/org/sonar/plugins/java/JavaAgenticWayProfileTest.java

@@ -53,7 +53,7 @@ void profile_is_registered_as_expected() {
     BuiltInQualityProfilesDefinition.BuiltInQualityProfile actualProfile = profilesPerLanguages.get("java").get("Sonar agentic AI");
     assertThat(actualProfile.isDefault()).isFalse();
     assertThat(actualProfile.rules())
-      .hasSize(468)
+      .hasSize(469)
       .extracting(BuiltInQualityProfilesDefinition.BuiltInActiveRule::ruleKey)
       .doesNotContainAnyElementsOf(List.of(
         "S101",

sonarpedia.json

@@ -3,7 +3,7 @@
   "languages": [
     "JAVA"
   ],
-  "latest-update": "2026-05-28T12:03:44.574588119Z",
+  "latest-update": "2026-06-01T14:28:02.258561Z",
   "options": {
     "no-language-in-filenames": true,
     "preserve-filenames": false