CLI-549 Add sonar integrate antigravity command and install orchestration

[nquinquenel]

Register integrate antigravity in the command tree, add integrateAntigravity() orchestration, register antigravity-cli in ALL_INTEGRATIONS, and CAG.

More to come

---

Summary by Gitar

• New Antigravity integration:
  • Registered antigravity command under sonar integrate with support for project and global scopes.
  • Implemented orchestration to configure secrets scanning hooks, Agentic Analysis, and MCP server setup.
• Configuration & Infrastructure:
  • Added Antigravity configuration constants for local (.agents/) and global (~/.gemini/config) workspaces.
  • Introduced antigravity-cli registry declaration to manage integration lifecycle and context augmentation.
• Testing:
  • Added comprehensive integration tests covering successful setup, idempotency, global configuration, and flag validation.
  • Included unit tests for resolving installation targets based on scope.

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

CLI-549

[sophio-japharidze-sonarsource]

Looks good! I think it's great to go in small increments. I would suggest to target master branch directly but not declare the new feature in command-tree.

[netlify]

✅ Deploy Preview for sonarqube-cli canceled.

Name	Link
🔨 Latest commit	f7edca3
🔍 Latest deploy log	https://app.netlify.com/projects/sonarqube-cli/deploys/6a2fc6457bff130008b58675

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
1 Accepted issue
0 New dependency risks

Measures
0 Security Hotspots
87.3% Coverage on New Code
0.0% Duplication on New Code

🛠️ Remediation Agent ready

• Fix automatically
  Creates a separate PR with fixes for eligible issues

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 3 resolved / 3 findings

Integrates the 'antigravity' command into the CLI and orchestrates its configuration, resolving the UTF-8 BOM issue in the pre-commit dependency file. No further issues found.

✅ 3 resolved

✅ Quality: New file git-pre-commit-dependency-risks.ts starts with a UTF-8 BOM

📄 src/cli/commands/hook/git-pre-commit-dependency-risks.ts:1
The new source file begins with a UTF-8 byte-order mark (U+FEFF) immediately before the /* license header (visible as the stray character on line 1). Every other .ts file in the repo starts directly with /* and has no BOM, so this is inconsistent with the codebase and with the project's mandatory prettier --write formatting step (Prettier strips BOMs, so the file likely was not run through it). A leading BOM can confuse some tooling/diffs and pollutes the license header. Remove the BOM so the file starts cleanly with /*.

✅ Quality: Antigravity command description advertises unimplemented features

📄 src/cli/command-tree.ts:253-255 📄 src/cli/commands/integrate/antigravity/declaration.ts:35-48
The command help text states: 'This will install secrets scanning hooks, configure SonarQube Agentic Analysis and MCP Server.' However, the antigravity integration declaration currently exposes only a no-op 'integration-setup' feature; per the code comments, secrets hooks, SQAA, and MCP are deferred to CLI-550/CLI-551. Running the command today does none of what the description promises, which is misleading to users. Consider tempering the description until those features land (e.g. note that setup is in progress) so the help text matches actual behavior.

✅ Bug: Unawaited rejects assertion makes 'invalid token' test ineffective

📄 tests/unit/cli/commands/integrate/antigravity/integrate.test.ts:86-91
The it('aborts when token is invalid', ...) callback is synchronous and the expect(...).rejects.toThrow('Token is invalid.') assertion is neither awaited nor returned. As a result the rejection assertion is fire-and-forget: the test completes before the promise settles, so a regression where integrateAntigravity resolves (or throws a different error) would not fail this test. The promise is also left dangling, which can surface as an unhandled rejection in another test. Additionally, expect(installIntegrationSpy).not.toHaveBeenCalled() runs synchronously immediately after kicking off the async call, so it passes trivially regardless of behavior. Make the callback async and await the rejection before asserting on the spy.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}