Differences sonar-scanner-cli container and Maven plugin

SonarQube Server / Community Build
1

Hi,
we changed sonar scanner execution from maven plugin:

<plugin>
  <groupId>org.sonarsource.scanner.maven</groupId>
  <artifactId>sonar-maven-plugin</artifactId>
  <version>3.9.1.2184</version>
</plugin>

to container sonarsource/sonar-scanner-cli:5
Container and plugin runs make use of our custom quality-gates and rules, but differ in results. In details:

  • ‘Remove usage of generic wildcard type. [java:S1452]’
  • ’ Make the enclosing method “static” or remove this set. [java:2696]

are not found by the container run. There are also some other differences. Both runs were executed with the same properties.
Sonarlint intelliJ plugin has the same results as the maven plugin run. Both runs analyze all files (other smells where found by both analyzers).

Does anybody else face that inconsistencies?

2

Hey there.

What version of SonarQube are you using?

And, you should always prefer using the Scanner for Maven for more accurate results.

3

Hello Colin,
thanks for your reply. We use SonarQube 10.1.0.73491.
Companies in medical device sector do not like phrases like ‘more accurate’ :wink:
Does scanner included in maven plugin deliver correct results?

4

All analysis tools will come with false-positives / false-negatives. No analysis tool is perfect.

The Scanner for Maven configures your analysis in a way that minimizes the chance of inaccurate results as the result of error-prone manual configuration.