Analysis parameters in Bitbucket pipeline seemingly ignored

SonarQube Cloud
, ,
1
  • ALM used: Bitbucket Cloud
  • CI system used: Bitbucket Cloud
  • Languages of the repository: Python, PL/SQL, Terraform

Hi,

when we perform a SonarQube Cloud scan through our Bitbucket pipeline, on the “Branch Summary” page on sonarcloud.io, we see “Last analysis had warnings”. When we click “View warnings”, we see the following:

Warnings in last analysis

Your code is analyzed as compatible with all Python 3 versions by default. You can get a more precise analysis by setting the exact Python version in your configuration via the parameter “sonar.python.version”

Provide the used AWS provider version via the “sonar.terraform.provider.aws.version” property to increase the accuracy of your results.

The Data Dictionary is not configured for the PLSQL analyzer, which prevents rule(s) S3641, S3921, S3618, S3651 from raising issues. See PL/SQL | SonarQube Cloud | Sonar Documentation

sq-01
sq-011654×114 8.85 KB

sq-02
sq-021068×730 67.7 KB

We would like to resolve these warnings and have created the following sonar-project.properties at the root of our project:

sonar.projectKey=our-project-key
sonar.organization=our-org-key

# Disable all PL/SQL rules requiring direct database access
sonar.issue.ignore.multicriteria=e1,e2,e3,e4
sonar.issue.ignore.multicriteria.e1.ruleKey=plsql:S3641
sonar.issue.ignore.multicriteria.e1.resourceKey=**/*.sql
sonar.issue.ignore.multicriteria.e2.ruleKey=plsql:S3921
sonar.issue.ignore.multicriteria.e2.resourceKey=**/*.sql
sonar.issue.ignore.multicriteria.e3.ruleKey=plsql:S3618
sonar.issue.ignore.multicriteria.e3.resourceKey=**/*.sql
sonar.issue.ignore.multicriteria.e4.ruleKey=plsql:S3651
sonar.issue.ignore.multicriteria.e4.resourceKey=**/*.sql

sonar.python.version=3.13

sonar.terraform.provider.aws.version=6.32.0

However, we still see the warnings (after a re-scan, of course).

We have also tried modifying our bitbucket-pipelines.yml as follows, yet all warnings still persist.

    - step:
        name: "SonarCloud scanning"
        script:
          - pipe: sonarsource/sonarcloud-scan:4.1.0
            variables:
              EXTRA_ARGS:
                - "-Dsonar.python.version=3.13"
                - "-Dsonar.terraform.provider.aws.version=6.32.0"
              SONAR_SCANNER_OPTS: "-Dsonar.python.version=3.13"

How can we resolve the warnings without having to make any changes in the SonarQube Cloud UI?

2

Hi,

You’re still seeing all 3 warnings with that properties file?

Unfortunately, you can only turn the PL/SQL warning off by providing a dictionary (which is a point I’ll raise internally.)

But based on the file you provided I would have expected the Python and AWS warnings to go away. Can you double-check that those two warnings still show up on the branch/PR you analyzed? I’m thinking that if you added this in a branch to test, the project homepage might be still showing stale warnings from your last main analysis.

 
Ann