# Compare Sonar analysis with main branch latest analysis and show the diff

**URL:** <https://community.sonarsource.com/t/compare-sonar-analysis-with-main-branch-latest-analysis-and-show-the-diff/117914>\
**Category:** SonarQube Server / Community Build\
**Created:** [June 26, 2024, 8:02am UTC](https://community.sonarsource.com/t/compare-sonar-analysis-with-main-branch-latest-analysis-and-show-the-diff/117914 "2024-06-26T08:02:53Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abhinav\_Raj](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/abhinav_raj/32/45742_2.png) [@Abhinav\_Raj](https://community.sonarsource.com/u/Abhinav_Raj)\
**Post date:** [June 26, 2024, 8:02am UTC](https://community.sonarsource.com/t/compare-sonar-analysis-with-main-branch-latest-analysis-and-show-the-diff/117914/1 "2024-06-26T08:02:53Z")

</div>

Must-share information (formatted with [Markdown](https://commonmark.org/help/)):

```auto
Sonarqube - 9.9
Plugin - org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.1.2184:sonar

```

We have setup the main branch as `develop` on Sonar and our development involves creating a feature branch out of the `develop` branch and then merging it into `develop` after development and testing.

For our `develop` branch there are a lot of Code smells, bugs, vulnerabilities that are currently in Old Code section (probably marked as not fixable), and now whenever a new feature branch is merged to develop, Sonar runs on the entire develop branch and only shows the new Code smells, bugs, etc that got introduced in the current PR, causing the quality gate to fail. Then we fix the issue and merge it again to develop thus solving the smell, bug, etc whatever came.

Is it possible to do this on the feature branch itself, basically run the Sonar scan on the entire feature branch but only show the code smells, bugs, etc. that are not there on the latest Scan of develop branch, essentially show me the diff in smells, bugs, etc.

For eg.  
Let us say the latest code of my `develop` (main branch) has 0 bugs, smells in the New Code section but the Old Code section has 100 smells. Then when I run the Sonar scan on my feature env branch and introduce 1 new smell, then it shows me 1 new smell as the diff and not the absolute 101 smells.

Edit.  
I did the above using

```auto
-Dsonar.branch.name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME -Dsonar.newCode.referenceBranch=develop

```

When I ran the above for first time, it showed me 1 new smell, which is what I wanted.  
Then I added another commit to my feature branch in which I introduced 1 new smell, now I ran the Sonar scanner again, this time it showed me 1 new smell (new one which I introduced in second commit), **whereas ideally it should have shown me 2 new smells compared to develop. How can I solve this particular problem?**

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [June 27, 2024, 1:24pm UTC](https://community.sonarsource.com/t/compare-sonar-analysis-with-main-branch-latest-analysis-and-show-the-diff/117914/2 "2024-06-27T13:24:26Z")

</div>

Hi,

Per [the docs](https://docs.sonarsource.com/sonarqube/latest/project-administration/clean-as-you-code-settings/defining-new-code/#new-code-definition-options),

> **Reference branch** : Available at the project and branch levels. Recommended for projects using feature branches. Choose a specific branch to define your new code. Any differences between your branch and the reference branch in the clone the scanner has access to at analysis time are considered new code.

Detection of new code is based on SCM data, and particularly when a reference branch is in use.

So was there an intermediate merge back into `develop` between the two commits to the branch? Are you sure the build agent had access to the correct iteration of `develop` at the time of analysis?

&nbsp;  
Ann

---

<div class="post-metadata">

**Author:** ![Abhinav\_Raj](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/abhinav_raj/32/45742_2.png) [@Abhinav\_Raj](https://community.sonarsource.com/u/Abhinav_Raj)\
**Post date:** [June 27, 2024, 5:59pm UTC](https://community.sonarsource.com/t/compare-sonar-analysis-with-main-branch-latest-analysis-and-show-the-diff/117914/3 "2024-06-27T17:59:07Z")

</div>

> So was there an intermediate merge back into `develop` between the two commits to the branch? Are you sure the build agent had access to the correct iteration of `develop` at the time of analysis?

Yes, there weren’t any intermediate commits.  
But do you mean to say that by using `-Dsonar.newCode.referenceBranch=develop` its essentially doing a diff of code between feature branch and develop branch, and then showing the issues on that diff code only?  
Doesnt that become equivalent to pull request way of doing things?  
`-Dsonar.pullrequest.branch=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME -Dsonar.pullrequest.base=$CI_MERGE_REQUEST_TARGET_BRANCH_NAME`

> basically run the Sonar scan on the entire feature branch but only show the code smells, bugs, etc. that are not there on the latest Scan of develop branch, essentially show me the diff in smells, bugs, etc.

I want something like this where we run the analysis runs on the entire feature branch, then compare the issues with the last scan results of the develop branch, and only show the diff of issues.

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [June 27, 2024, 6:02pm UTC](https://community.sonarsource.com/t/compare-sonar-analysis-with-main-branch-latest-analysis-and-show-the-diff/117914/4 "2024-06-27T18:02:45Z")

</div>

Hi,

Branch analysis is always going to show all issues. But with a reference branch New Code definition, what shows up under ‘new’ will be the changes since the reference branch.

> [@Abhinav\_Raj](#):
>
> compare the issues with the last scan results of the develop branch,

It doesn’t work against the latest version of `develop` but versus the branch point.

> [@Abhinav\_Raj](#):
>
> and only show the diff of issues.

Now _that_ is more like PR analysis.

&nbsp;  
HTH,  
Ann

---

<div class="post-metadata">

**Author:** ![Abhinav\_Raj](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/abhinav_raj/32/45742_2.png) [@Abhinav\_Raj](https://community.sonarsource.com/u/Abhinav_Raj)\
**Post date:** [June 27, 2024, 6:16pm UTC](https://community.sonarsource.com/t/compare-sonar-analysis-with-main-branch-latest-analysis-and-show-the-diff/117914/5 "2024-06-27T18:16:12Z")

</div>

> what shows up under ‘new’ will be the changes since the reference branch.

can you elaborate on what is meant by `changes` here?

> but versus the branch point.

you mean the previous scan of the feature branch?

I guess I was hoping to achieve something similar to what is currently an issue with Sonar - [https://portal.productboard.com/sonarsource/3-sonarqube/c/295-new-pull-request-issues-on-unchanged-code](https://portal.productboard.com/sonarsource/3-sonarqube/c/295-new-pull-request-issues-on-unchanged-code)

We have been struggling a lot with this lately, where the new code itself is not showing any issue upon scanning (we do the PR analysis), but when its merged to develop branch and full scan runs on the develop branch, then we see some issues.

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [June 27, 2024, 6:19pm UTC](https://community.sonarsource.com/t/compare-sonar-analysis-with-main-branch-latest-analysis-and-show-the-diff/117914/6 "2024-06-27T18:19:18Z")

</div>

Hi,

> [@Abhinav\_Raj](#):
>
> you mean the previous scan of the feature branch?

No. I mean the changes since the branch diverged in the SCM from the base branch, independent of the last branch analysis.

> [@Abhinav\_Raj](#):
>
> I guess I was hoping to achieve something similar to what is currently an issue with Sonar - [https://portal.productboard.com/sonarsource/3-sonarqube/c/295-new-pull-request-issues-on-unchanged-code](https://portal.productboard.com/sonarsource/3-sonarqube/c/295-new-pull-request-issues-on-unchanged-code)

That’s shows up as a portal card because it hasn’t been implemented yet. 🙂

&nbsp;  
Ann

---

<div class="post-metadata">

**Author:** ![Abhinav\_Raj](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/abhinav_raj/32/45742_2.png) [@Abhinav\_Raj](https://community.sonarsource.com/u/Abhinav_Raj)\
**Post date:** [June 27, 2024, 6:28pm UTC](https://community.sonarsource.com/t/compare-sonar-analysis-with-main-branch-latest-analysis-and-show-the-diff/117914/7 "2024-06-27T18:28:33Z")

</div>

So to summarize my understanding, when we use `-Dsonar.newCode.referenceBranch=develop`  
Sonar runs the full branch analysis on feature branch, but in the new section it only shows the issues that are there on the code that is there in feature branch and not there in develop branch?  
Please confirm this.

A follow up on reference branch usage - does Sonar always use the latest version of reference branch that is available in SCM at that time?

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [June 27, 2024, 6:56pm UTC](https://community.sonarsource.com/t/compare-sonar-analysis-with-main-branch-latest-analysis-and-show-the-diff/117914/8 "2024-06-27T18:56:00Z")

</div>

Hi,

> [@Abhinav\_Raj](#):
>
> Sonar does a **diff of code** between the feature branch and reference branch

No.

SonarQube analyzes the whole code base. The entire thing. Every line and file.

What shows up under New Code is what has changed since the branch point.

&nbsp;  
HTH,  
Ann
