- Using SonarQube Server Developer Edition v2026.3.1 (123439) and SonarScanner CLI 8.0.1.6346
- Deployed as Docker (sonarqube:developer - d5eb2c1d4d3b) as well as sonnar-scanner-cli as Docker (sonarsource/sonar-scanner-cli:latest - 8368f5531d4d)
- I would like to scan a local copy of a Github repository focussing on security aspects and vulnerabilities. The code mainly consists of PHP and JS files
- The issue is that Code Coverage is at 0%. The logs seem ok except for the sonar.php.coverage.reportPaths and sonar.php.tests.reportPaths parameters. I tried to not specify them and also to specify them but in any case the Coverage remains 0%.
My code is in ~/gitexport/. This is also the current working directory from which I invoke the CLI scanner as follows:
docker run --rm --network sonarnet \
-e SONAR_HOST_URL="http://sonarqubedev:9000" \
-e SONAR_TOKEN="sqa_d3da916ad4c1ec08f9c3721ceae548ff143b18b5" \
-v ".:/usr/src" \
sonarsource/sonar-scanner-cli
Inside the CWD there is a sonar-project.properties with the following contents
# must be unique in a given SonarQube instance
sonar.projectKey=my:project
# --- optional properties ---
# defaults to project key
#sonar.projectName=My project
# defaults to 'not provided'
#sonar.projectVersion=1.0
# Path is relative to the sonar-project.properties file. Defaults to .
#sonar.sources=.
# Encoding of the source code. Default is default system encoding
#sonar.sourceEncoding=UTF-8
sonar.php.coverage.reportPaths=coverage.xml
sonar.php.tests.reportPaths=test.xml
The run of the scanner looks pretty good (see below) except for the following errors:
18:50:59.458 INFO No PHPUnit tests reports provided (see 'sonar.php.tests.reportPath' property)
18:50:59.461 INFO Importing /usr/src/coverage.xml
18:50:59.489 WARN An error occurred when reading report file '/usr/src/coverage.xml', nothing will be imported from this report. IOException: /usr/src/coverage.xml (No such file or directory)
Clearly, I am doing something wrong with those two parameters. Here is the full output:
18:49:01.289 INFO Scanner configuration file: /opt/sonar-scanner/conf/sonar-scanner.properties
18:49:01.302 INFO Project root configuration file: /usr/src/sonar-project.properties
18:49:01.353 INFO SonarScanner CLI 8.0.1.6346
18:49:01.364 INFO Linux 6.12.76-linuxkit amd64
18:49:05.874 INFO Communicating with SonarQube Server 2026.3.1.123439
18:49:05.876 INFO JRE provisioning: os[linux], arch[x86_64]
18:49:18.359 INFO Starting SonarScanner Engine...
18:49:18.360 INFO Java 21.0.9 Eclipse Adoptium (64-bit)
18:49:23.006 INFO Load global settings
18:49:23.195 INFO Load global settings (done) | time=192ms
18:49:23.202 INFO Server id: 147B411E-AZ-Uwab2EptiY7YJtnWs
18:49:23.247 INFO Loading required plugins
18:49:23.248 INFO Load plugins index
18:49:23.314 INFO Load plugins index (done) | time=67ms
18:49:23.315 INFO Load/download plugins
18:49:24.489 INFO Load/download plugins (done) | time=1173ms
18:49:24.693 INFO Loaded core extensions: developer-scanner
18:49:25.112 INFO Process project properties
18:49:25.114 INFO Process project properties (done) | time=1ms
18:49:25.140 INFO Project key: my:project
18:49:25.149 INFO Base dir: /usr/src
18:49:25.151 INFO Working dir: /tmp/.scannerwork
18:49:25.445 INFO Load project settings for component key: 'my:project'
18:49:25.504 INFO Load project settings for component key: 'my:project' (done) | time=56ms
18:49:25.551 INFO Load project branches
18:49:25.591 INFO Load project branches (done) | time=38ms
18:49:25.593 INFO Load branch configuration
18:49:25.596 INFO Load branch configuration (done) | time=3ms
18:49:25.612 INFO Load quality profiles
18:49:26.008 INFO Load quality profiles (done) | time=396ms
18:49:26.087 INFO Load active rules
18:49:27.550 INFO Load active rules (done) | time=1463ms
18:49:27.578 INFO Load analysis cache
18:49:27.866 INFO Load analysis cache | time=287ms
18:49:28.330 INFO Preprocessing files...
18:49:29.048 INFO 4 languages detected in 342 preprocessed files (done) | time=718ms
18:49:29.053 INFO 28 files ignored because of scm ignore settings
18:49:29.057 INFO Loading plugins for detected languages
18:49:29.060 INFO Load/download plugins
18:49:36.054 INFO Load/download plugins (done) | time=6998ms
18:49:36.382 INFO Load project repositories
18:49:36.659 INFO Load project repositories (done) | time=277ms
18:49:36.703 INFO Indexing files...
18:49:36.705 INFO Project configuration:
18:49:38.204 INFO 340 files indexed (done) | time=1499ms
18:49:38.210 INFO Quality profile for css: Sonar way
18:49:38.211 INFO Quality profile for js: Sonar way
18:49:38.212 INFO Quality profile for json: Sonar way
18:49:38.214 INFO Quality profile for php: Sonar way
18:49:38.222 INFO ------------- Run sensors on module my:project
18:49:38.335 INFO Load metrics repository
18:49:38.394 INFO Load metrics repository (done) | time=60ms
18:49:38.791 INFO Reflections took 122 ms to scan 1 urls, producing 26 keys and 266 values
18:49:40.424 INFO Sensor HTML [web]
18:49:43.662 INFO Sensor HTML [web] (done) | time=3238ms
18:49:43.669 INFO Sensor JasminFileCollectorSensor [jasmin]
18:49:43.670 INFO Sensor JasminFileCollectorSensor [jasmin] (done) | time=12ms
18:49:43.674 INFO Sensor PHP sensor [php]
18:49:43.911 INFO Starting PHP symbol indexer
18:49:44.004 INFO 200 source files to be analyzed
18:49:54.009 INFO 103/200 files analyzed, current file: plugin/includes/ERecht24/SyncService.php
18:50:02.837 INFO 200/200 source files have been analyzed
18:50:02.838 INFO Cached information of global symbols will be used for 0 out of 200 files. Global symbols were recomputed for the remaining files.
18:50:02.900 INFO Starting PHP rules
18:50:02.906 INFO 200 source files to be analyzed
18:50:12.907 INFO 27/200 files analyzed, current file: plugin/includes/Ausweisverifikation/class-av-admin.php
18:50:22.912 INFO 66/200 files analyzed, current file: plugin/includes/Social/Cron.php
18:50:32.908 INFO 104/200 files analyzed, current file: plugin/includes/Plugin.php
18:50:42.909 INFO 137/200 files analyzed, current file: plugin/includes/System/Includes/sociallinkdisplay-core.php
18:50:52.909 INFO 181/200 files analyzed, current file: plugin/includes/Social/OAuthController.php
18:50:59.443 INFO 200/200 source files have been analyzed
18:50:59.445 INFO The PHP analyzer was able to leverage cached data from previous analyses for 0 out of 200 files. These files were not parsed.
18:50:59.447 INFO Sensor PHP sensor [php] (done) | time=75772ms
18:50:59.447 INFO Sensor Analyzer for "php.ini" files [php]
18:50:59.455 INFO Sensor Analyzer for "php.ini" files [php] (done) | time=10ms
18:50:59.457 INFO Sensor PHPUnit report sensor [php]
18:50:59.458 INFO No PHPUnit tests reports provided (see 'sonar.php.tests.reportPath' property)
18:50:59.461 INFO Importing /usr/src/coverage.xml
18:50:59.489 WARN An error occurred when reading report file '/usr/src/coverage.xml', nothing will be imported from this report. IOException: /usr/src/coverage.xml (No such file or directory)
18:50:59.620 INFO Sensor PHPUnit report sensor [php] (done) | time=165ms
18:50:59.621 INFO Sensor IaC hadolint report Sensor [iac]
18:50:59.623 INFO Sensor IaC hadolint report Sensor [iac] (done) | time=1ms
18:50:59.624 INFO Sensor Java Config Sensor [iac]
18:50:59.639 INFO There are no files to be analyzed for the Java language
18:50:59.639 INFO Sensor Java Config Sensor [iac] (done) | time=16ms
18:50:59.641 INFO Sensor IaC Docker Sensor [iac]
18:50:59.647 INFO There are no files to be analyzed for the Docker language
18:50:59.648 INFO Sensor IaC Docker Sensor [iac] (done) | time=8ms
18:50:59.649 INFO Sensor IaC GitHub Actions Sensor [iac]
18:50:59.650 INFO There are no files to be analyzed for the GitHub Actions language
18:50:59.651 INFO Sensor IaC GitHub Actions Sensor [iac] (done) | time=2ms
18:50:59.652 INFO Sensor IaC actionlint report Sensor [iac]
18:50:59.652 INFO Sensor IaC actionlint report Sensor [iac] (done) | time=0ms
18:50:59.652 INFO Sensor IaC Shell Sensor [iac]
18:50:59.653 INFO There are no files to be analyzed for the Shell language
18:50:59.653 INFO Sensor IaC Shell Sensor [iac] (done) | time=0ms
18:50:59.653 INFO Sensor PhpModuleSecuritySensor [securityphpfrontend]
18:50:59.654 INFO Sensor PhpModuleSecuritySensor [securityphpfrontend] (done) | time=0ms
18:50:59.654 INFO Sensor JavaScript/TypeScript/CSS analysis [javascript]
18:51:00.309 INFO Detected os: Linux arch: amd64 alpine: false. Platform: LINUX_X64
18:51:00.311 INFO Deploy location /opt/sonar-scanner/.sonar/js/node-runtime, tagetRuntime: /opt/sonar-scanner/.sonar/js/node-runtime/node, version: /opt/sonar-scanner/.sonar/js/node-runtime/version.txt
18:51:05.326 INFO Using embedded Node.js runtime.
18:51:05.327 INFO Using Node.js executable: '/opt/sonar-scanner/.sonar/js/node-runtime/node'.
18:51:12.818 INFO Memory configuration: OS (3911 MB), Node.js (2148 MB).
18:51:12.869 INFO gRPC analyze-project server listening on 127.0.0.1:37217
18:51:16.038 INFO Plugin version: [12.4.0.40770]
18:51:16.323 WARN Invalid character encountered in file /usr/src/plugin/assets/js/ace/worker-html.js at line 1 for encoding UTF-8. Please fix file content or configure the encoding to be used using property 'sonar.sourceEncoding'.
18:51:19.152 INFO Some of the project files were automatically excluded because they looked like generated code. Enable debug logging to see which files were excluded. You can disable bundle detection by setting sonar.javascript.detectBundles=false
18:51:19.567 INFO Found 0 tsconfig.json file(s): []
18:51:35.625 INFO 21 source files to be analyzed
18:51:35.630 INFO Analyzing 10 file(s) using default options [lib: lib.esnext.d.ts, lib.dom.d.ts]
18:51:35.631 INFO 21/21 source files have been analyzed
18:51:35.756 INFO JasminAstConsumer done
18:51:35.771 INFO Hit the cache for 0 out of 20
18:51:35.773 INFO Miss the cache for 20 out of 20: ANALYSIS_MODE_INELIGIBLE [20/20]
18:51:35.774 INFO Sensor JavaScript/TypeScript/CSS analysis [javascript] (done) | time=36083ms
18:51:35.778 INFO Sensor DeveloperTextAndSecretsSensor [textdeveloper]
18:51:36.320 INFO Available processors: 4
18:51:36.342 INFO Using 4 threads for analysis.
18:51:40.742 INFO The property "sonar.tests" is not set. To improve the analysis accuracy, we categorize a file as a test file if any of the following is true:
* The filename starts with "test"
* The filename contains "test." or "tests."
* Any directory in the file path is named: "doc", "docs", "test", "tests", "mock" or "mocks"
* Any directory in the file path has a name ending in "test" or "tests"
18:51:42.838 INFO Start fetching files for the text and secrets analysis
18:51:43.519 INFO Using Git CLI to retrieve dirty files
18:51:48.121 INFO Retrieving language associated files and files included via "sonar.text.inclusions" that are tracked by git
18:51:48.129 INFO Starting the text and secrets analysis
18:51:48.155 INFO 234 source files to be analyzed for the text and secrets analysis
18:51:58.443 INFO 122/234 files analyzed, current files: plugin/assets/js/dashboard.js, plugin/includes/Plugin.php, plugin/includes/Emails/TemplateEditor.php, ...
18:52:08.482 INFO 223/234 files analyzed, current files: plugin/assets/js/ace/worker-html.js, plugin/assets/js/ace/ace.js, plugin/assets/css/dashboard.css, ...
18:52:10.169 INFO 234/234 source files have been analyzed for the text and secrets analysis
18:52:10.496 INFO Start fetching files for the binary file analysis
18:52:10.504 INFO There are no files to be analyzed for the binary file analysis
18:52:11.421 INFO 1 file is ignored because it is untracked by git or has been modified
18:52:12.566 INFO Sensor DeveloperTextAndSecretsSensor [textdeveloper] (done) | time=36237ms
18:52:12.626 INFO Sensor PhpSecuritySensor [security]
18:52:13.160 INFO 19 taint analysis rules enabled.
18:52:58.206 INFO Analyzing 3148 UCFGs to detect vulnerabilities.
18:53:00.992 INFO All rules entry points : 383
18:53:01.023 INFO Retained UCFGs : 1728
18:53:02.214 INFO 0 / 1728 UCFGs simulated, memory usage: 215 MB
18:53:05.335 INFO 521 / 1728 UCFGs simulated, memory usage: 275 MB
18:53:33.358 INFO Too high simulation costs for sink in /usr/src/plugin/includes/System/Logger.php:183. This sink will not be analyzed any further.
18:53:33.361 INFO Too high simulation costs for sink in /usr/src/plugin/includes/System/Logger.php:191. This sink will not be analyzed any further.
18:53:33.362 INFO Too high simulation costs for sink in /usr/src/plugin/includes/System/Logger.php:196. This sink will not be analyzed any further.
18:53:33.413 INFO 1083 / 1728 UCFGs simulated, memory usage: 162 MB
18:53:34.543 INFO 1527 / 1728 UCFGs simulated, memory usage: 267 MB
18:53:34.661 INFO 1540 / 1728 UCFGs simulated, memory usage: 286 MB
18:53:34.720 WARN Failed to find InputFile for __unknown_file, check exclusions.
18:53:34.852 INFO php security sensor: Begin: 2026-07-28T18:52:12.105555283Z, End: 2026-07-28T18:53:34.846172871Z, Duration: 00:01:22.740
Load type hierarchy and UCFGs: Begin: 2026-07-28T18:52:12.134689452Z, End: 2026-07-28T18:52:58.168103852Z, Duration: 00:00:46.033
Load type hierarchy: Begin: 2026-07-28T18:52:12.134718464Z, End: 2026-07-28T18:52:17.025266564Z, Duration: 00:00:04.890
Load UCFGs: Begin: 2026-07-28T18:52:17.025739659Z, End: 2026-07-28T18:52:58.167923046Z, Duration: 00:00:41.142
Check cache: Begin: 2026-07-28T18:52:58.168714221Z, End: 2026-07-28T18:52:58.171723006Z, Duration: 00:00:00.003
Load cache: Begin: 2026-07-28T18:52:58.171019036Z, End: 2026-07-28T18:52:58.171216124Z, Duration: 00:00:00.000
Create runtime call graph: Begin: 2026-07-28T18:52:58.171823496Z, End: 2026-07-28T18:53:00.081022845Z, Duration: 00:00:01.909
Create declared type propagation graph: Begin: 2026-07-28T18:52:58.177088263Z, End: 2026-07-28T18:52:59.154038768Z, Duration: 00:00:00.976
Run SCC (Tarjan) on 23935 nodes: Begin: 2026-07-28T18:52:59.161696091Z, End: 2026-07-28T18:52:59.196150288Z, Duration: 00:00:00.034
Propagate runtime types to strongly connected components: Begin: 2026-07-28T18:52:59.196260931Z, End: 2026-07-28T18:52:59.270755133Z, Duration: 00:00:00.074
Variable Type Analysis #1: Begin: 2026-07-28T18:52:59.275258564Z, End: 2026-07-28T18:52:59.677680643Z, Duration: 00:00:00.402
Create runtime type propagation graph: Begin: 2026-07-28T18:52:59.275278313Z, End: 2026-07-28T18:52:59.566863538Z, Duration: 00:00:00.291
Run SCC (Tarjan) on 27811 nodes: Begin: 2026-07-28T18:52:59.567723520Z, End: 2026-07-28T18:52:59.608832872Z, Duration: 00:00:00.041
Propagate runtime types to strongly connected components: Begin: 2026-07-28T18:52:59.608927432Z, End: 2026-07-28T18:52:59.677558359Z, Duration: 00:00:00.068
Variable Type Analysis #2: Begin: 2026-07-28T18:52:59.679266316Z, End: 2026-07-28T18:53:00.070469567Z, Duration: 00:00:00.391
Create runtime type propagation graph: Begin: 2026-07-28T18:52:59.679277422Z, End: 2026-07-28T18:52:59.982059129Z, Duration: 00:00:00.302
Run SCC (Tarjan) on 27700 nodes: Begin: 2026-07-28T18:52:59.983295996Z, End: 2026-07-28T18:53:00.015260679Z, Duration: 00:00:00.031
Propagate runtime types to strongly connected components: Begin: 2026-07-28T18:53:00.015449027Z, End: 2026-07-28T18:53:00.070364587Z, Duration: 00:00:00.054
Load config: Begin: 2026-07-28T18:53:00.081125146Z, End: 2026-07-28T18:53:00.633270341Z, Duration: 00:00:00.552
Compute entry points: Begin: 2026-07-28T18:53:00.633432899Z, End: 2026-07-28T18:53:00.984598326Z, Duration: 00:00:00.351
Slice call graph: Begin: 2026-07-28T18:53:00.985090685Z, End: 2026-07-28T18:53:01.227943515Z, Duration: 00:00:00.242
Live variable analysis: Begin: 2026-07-28T18:53:01.228057647Z, End: 2026-07-28T18:53:02.188156214Z, Duration: 00:00:00.960
Taint analysis for php: Begin: 2026-07-28T18:53:02.189861137Z, End: 2026-07-28T18:53:34.651825564Z, Duration: 00:00:32.461
Report issues: Begin: 2026-07-28T18:53:34.652402957Z, End: 2026-07-28T18:53:34.749388845Z, Duration: 00:00:00.096
Store cache: Begin: 2026-07-28T18:53:34.750794830Z, End: 2026-07-28T18:53:34.830935350Z, Duration: 00:00:00.080
18:53:34.876 INFO php security sensor peak memory: 510 MB
18:53:34.877 INFO Sensor PhpSecuritySensor [security] (done) | time=82877ms
18:53:34.893 INFO ------------- Run sensors on project
18:53:35.441 INFO Sensor JsSecuritySensorV2 [jasmin]
18:53:35.652 INFO 10 file(s) will be analysed by SonarJasmin.
18:53:40.543 INFO Analysis progress: 10% (1/10 files)
18:53:40.552 INFO Analysis progress: 20% (2/10 files)
18:53:40.561 INFO Analysis progress: 30% (3/10 files)
18:53:40.582 INFO Analysis progress: 40% (4/10 files)
18:53:40.656 INFO Analysis progress: 50% (5/10 files)
18:53:40.679 INFO Analysis progress: 60% (6/10 files)
18:53:40.684 INFO Analysis progress: 70% (7/10 files)
18:53:40.690 INFO Analysis progress: 80% (8/10 files)
18:53:40.697 INFO Analysis progress: 90% (9/10 files)
18:53:40.758 INFO Sensor JsSecuritySensorV2 [jasmin] (done) | time=5316ms
18:53:40.760 INFO Sensor JsArchitectureSensor [architecture]
18:53:40.961 INFO Found 1 potential Udg file location(s) for "js" in "/tmp/.scannerwork"
18:53:40.963 INFO - /tmp/.scannerwork/architecture/js
18:53:41.035 INFO Architecture analysis is enabled with the following features: legacy, smells
18:53:41.045 INFO * Protobuf reading starting | memory total=524 | free=166 | used=357 (MB)
18:53:41.047 INFO * Reading SonarArchitecture UDG data from directory "/tmp/.scannerwork/architecture/js"
18:53:41.329 INFO * Files successfully loaded: "10" out of "10"
18:53:41.329 INFO * Purging externals (components not scanned) from graphs
18:53:41.331 INFO * Purging excluded nodes from graphs
18:53:41.332 INFO * Protobuf reading complete | memory total=524 | free=154 | used=369 (MB)
18:53:41.401 INFO * Build architecture.graph.js.file_graph.default_perspective hierarchy graph complete (filtered=false) | memory total=524 | free=150 | used=373 (MB)
18:53:41.425 INFO * No intended architecture defined or detected, using an empty model
18:53:41.491 INFO Sensor JsArchitectureSensor [architecture] (done) | time=732ms
18:53:41.493 INFO Sensor Zero Coverage Sensor
18:53:41.636 INFO Sensor Zero Coverage Sensor (done) | time=144ms
18:53:41.640 INFO Sensor Architecture Telemetry [architecture]
18:53:41.641 INFO Sensor Architecture Telemetry [architecture] (done) | time=0ms
18:53:41.644 INFO ------------- Gather SCA dependencies on project
18:53:41.659 INFO Dependency analysis skipped
18:53:41.844 INFO CPD Executor 13 files had no CPD blocks
18:53:41.847 INFO CPD Executor Calculating CPD for 208 files
18:53:42.142 INFO CPD Executor CPD calculation finished (done) | time=296ms
18:53:42.201 INFO SCM revision ID '560de16661b7bf0eea1734b099b0d21f92962ca1'
18:53:43.373 INFO Load New Code definition
18:53:43.484 INFO Load New Code definition (done) | time=129ms
18:53:43.566 INFO Analysis report generated in 1346ms, dir size=13.4 MB
18:53:45.187 INFO Analysis report compressed in 1573ms, zip size=7.1 MB
18:53:46.422 INFO Analysis report uploaded in 1282ms
18:53:46.432 INFO ANALYSIS SUCCESSFUL, you can find the results at: http://sonarqubedev:9000/dashboard?id=my%3Aproject
18:53:46.441 INFO Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
18:53:46.449 INFO More about the report processing at http://sonarqubedev:9000/api/ce/task?id=190033d0-cb94-4ece-8cd8-ec179f3af569
18:53:46.655 INFO Analysis total time: 4:21.959 s
18:53:46.663 INFO SonarScanner Engine completed successfully
18:53:47.211 INFO EXECUTION SUCCESS
18:53:48.624 INFO Total time: 4:45.969s
andre@MacBook-Pro SocialhubV2 % docker run sonarsource/sonar-scanner-cli
19:03:32.400 INFO Scanner configuration file: /opt/sonar-scanner/conf/sonar-scanner.properties
19:03:32.411 INFO Project root configuration file: NONE
19:03:32.472 INFO SonarScanner CLI 8.0.1.6346
19:03:32.488 INFO Linux 6.12.76-linuxkit amd64
19:03:36.364 INFO Communicating with SonarQube Cloud
19:03:36.366 INFO JRE provisioning: os[linux], arch[x86_64]
19:03:49.886 INFO Starting SonarScanner Engine...
19:03:49.888 INFO Java 21.0.11 Eclipse Adoptium (64-bit)
19:03:53.138 INFO Load global settings
19:03:53.989 INFO Load global settings (done) | time=840ms
19:03:54.202 INFO Server id: 1BD809FA-AWHW8ct9-T_TB3XqouNu
19:03:54.778 INFO Loading required plugins
19:03:54.779 INFO Load plugins index
19:03:54.854 INFO Load plugins index (done) | time=75ms
19:03:54.855 INFO Load/download plugins
19:04:00.376 INFO Load/download plugins (done) | time=5505ms
19:04:01.319 INFO Loaded core extensions: a3s, sca, architecture
19:04:02.679 INFO Process project properties
19:04:03.076 ERROR You must define the following mandatory properties for 'Unknown': sonar.projectKey, sonar.organization
19:04:03.625 INFO EXECUTION FAILURE
19:04:03.642 INFO Total time: 31.246s
This ends up with 0% coverage as follows:
Any advice is highly appreciated.
Thanks in advance.