OpenRewrite vs Sourcery

OpenRewrite is an open-source ecosystem for automated code refactoring, aimed at updating code and reducing technical debt. It represents code as Lossless Semantic Trees, applies transformations, and prints the result back into source code for review. Its recipes cover framework migrations, security fixes, and style consistency, and can be written in YAML, Refaster templates, or Java. Maven and Gradle plugins run recipes locally as part of builds, one repository at a time. The Maven plugin offers a dry run that reports potential changes and writes diff files; recipes run only when explicitly activated by name. Documented support includes Java, Kotlin, and Groovy, plus formats such as HCL, JSON, Properties, Protobuf, TOML, XML, and YAML. Framework coverage includes Spring, Quarkus, and Micronaut. The recipe index lists 4,183 recipes across modules. Core and language libraries use Apache License 2.0, but some recipes have other licensing terms. Core is free; some artifacts require authenticated repository access, and some recipes require a Moderne subscription.

Sourcery reviews pull requests with AI, returning a summary, review comments and suggested fixes within minutes. Users can apply a suggestion as a change and commit it to the pull request. Security checks cover committed secrets, static-analysis vulnerabilities, infrastructure-as-code misconfigurations, dependencies and licenses. The extension works in VS Code, Cursor, Windsurf and JetBrains editors, and Sourcery supports GitHub, GitLab, GitHub Enterprise Server and self-hosted GitLab. Open Source checks security on every pull request; Open Source and Pro also scan twice a week, while Team includes nightly scans. The public REST API, for listing, reading, counting and bulk-updating security findings and groups, is a Team feature. Open Source is free; Pro is $12 a month billed annually, or $15 per developer per month billed monthly. Team is $24 a month billed annually, or $30 per developer per month billed monthly. A 14-day Team-feature trial is available organization-wide after installation, without a credit card. Sourcery says it does not retain customer code after reviews or use it to train models.