Bitbucket pipelines - sonar pipe: xargs: unmatched single quote; by default quotes are special to xargs unless you use the -0 option

SonarQube Cloud
, ,
1

I am using the sonar cloud pipe in a bitbucket pipeline, in order to evaluate the coverage of the incoming commits inside a Pull Request.

According to this, I have in the bitbucket-pipelines.yml file one analysis for the base branch where I want to do the PR (let’s say develop branch) and one analysis for the branch I’ve created for the PR. It is configured in this way.

See at the steps attribute section below:

image:
  name: gcr.io/my-project/my-application:latest
  username: _json_key
  password: '$GCR_JSON_KEY'

options:
  max-time: 45 # Allow a pipeline to run for 45 minutes max

clone:
  depth: full       # include the last 100 commits

definitions:
  services:
    gcloudemulators:
      image: gcr.io/my-project/my-application-test:latest
    docker:
      memory: 2048  
  caches:
    sonar: ~/.sonar/cache  # Caching SonarCloud artifacts will speed up your build

  steps:
    # RUNNING SONAR CLOUD FOR BASE BRANCH  
    - step: &run-sonarcloud-analysis
        name: Run SonarCloud analysis
        size: 2x
        services:
          - docker
        caches:
          - sonar
          - docker
        script:
          - pipe: sonarsource/sonarcloud-scan:1.4.0
            variables:
              DEBUG: "true"
              EXTRA_ARGS: -Dsonar.branch.name=\'"$BITBUCKET_BRANCH\"'
              SONAR_SCANNER_OPTS: "-Xmx1600m"
    - step:
        script:
          - echo "Current branch is:"  '"$BITBUCKET_BRANCH"'
    
    # RUNNING SONAR CLOUD FOR INCOMING PULL REQUEST BRANCH
    - step: &run-sonarcloud-analysis-for-pull-request
        name: Run SonarCloud analysis for Pull Request
        clone:
          depth: full
        size: 2x
        services:
          - docker
        caches:
          - sonar
          - docker
        script:
          - pipe: sonarsource/sonarcloud-scan:1.4.0
            variables:
              DEBUG: "true"
              EXTRA_ARGS: -Dsonar.pullrequest.branch=\"$BITBUCKET_BRANCH\" -Dsonar.pullrequest.base=\"$BITBUCKET_PR_DESTINATION_BRANCH\" -Dsonar.pullrequest.key=\"$BITBUCKET_PR_ID\"
              SONAR_SCANNER_OPTS: "-Xmx1600m"

When the pipeline is executed, I got this error at the first pipe: sonarsource/... defined:

xargs: unmatched single quote; by default quotes are special to xargs unless you use the -0 option

I think this is due to the single quotes that enclose the BITBUCKET_BRANCH at the branch.name argument:

EXTRA_ARGS: -Dsonar.branch.name=\'"$BITBUCKET_BRANCH\"'

I had to “escape it” in that way to allow me to get the value of the current destination or base branch when doing the PR and the analysis from sonar cloud.
I did this according to this answer, but now I don’t know how to overcome the above error.

I also tried to have a look at the documentation but I am a bit confused about which guide should I use, since I found the sonarcloud analysis parameters and the sonar cloud pull request analysis where any of the -Dsonar.branch.name, -Dsonar.pullrequest.branch and -Dsonar.pullrequest.base arguments seem to be valid or at least they are not there.

On the other hand, I see on sonarqube documentation the pullrequest arguments are there.

What is the difference between sonarcloud (the code quality cloud service) and sonarqube (the open-source platform to do the same)?

Which documentation should I follow? I believe sonarqube (?)

Thanks in advance.

2

Hey there.

I have a hard time understanding what you’re trying to do here.

  1. Why are you running an analysis for both the “base” branch and the pull request? It shouldn’t be necessary to do both.
  2. When running a PR analysis in Bitbucket Pipelines with the sonarsource/sonarcloud-scan pipe, it shouldn’t be necessary to set sonar.pullrequest.* – they should all be set automatically. Any attempt at setting them manual turns this automatic configuration off.
3

Hi Colin, thanks for your remark!
I see, I removed the single quotes to get rid of that error.

Now, regarding PR should be included automatically with the sonarsource/sonarcloud-scan pipe,
does it have to do with this?

When a project is first imported into SonarCloud and analyzed by automatic analysis the first analysis behaves differently from subsequent analyses. On the first analysis not only will the main branch be analyzed, but, also the most recently active pull requests, up to a maximum of five . The main branch and pull request results will appear on the project overview, as usual. Subsequent analyses will occur normally, on pushes to the main branch and on pushes to pull request branches.

Following your remarks, I’ve removed the analysis for the pull request, and I still can see this PR on the last activity as a new analysis, so it means it was involved automatically as you pointed out, right?

image
image1578×486 47.3 KB

But the thing is that if I go to Pull Requests section, I cannot see that new analysis, I only can see my previous PR which ones were successful:

image
image1712×298 32.7 KB

So the most recent PR is not being included at all? Or is it just because it is failing?

I would like to get more comprehension about analyzing PR, since the documentation seems to be simple.

Perhaps do I need to involve the sonarsource/sonarcloud-scan pipe here:?
Something like:

pipelines:
  ...
  pull-requests:
    feature/*:
      - step:
          script:
            # - mvn sonar:sonar
            - pipe: sonarsource/sonarcloud-scan:1.4.0
              variables:
                DEBUG: "true"
                EXTRA_ARGS: -Dsonar.branch.name=\"$BITBUCKET_BRANCH\"
                SONAR_SCANNER_OPTS: "-Xmx1600m"
  ...