Excluding Shared Library Submodule from SonarCloud Analysis

SonarQube Cloud
1

ALM used

Azure DevOps

CI system used

Azure DevOps Pipelines

Scanner command used

Using SonarCloud analysis as part of our Azure DevOps pipeline.

Languages of the repository

C#

Error observed

We have a shared library project included as a Git submodule in multiple applications. The library is a generic, reusable component that is maintained separately and used across several projects.

We do not want this library to be included in the SonarCloud analysis of individual applications, as it results in duplicate analysis and contributes to the LOC count in each project.

We have already added the library path to the exclusion settings, but the library files are still being analyzed.

We’ve been using SonarCloud for several years, and this setup was working as expected previously. We’ve only recently noticed that the shared library is being included in the analysis despite the configured exclusions.

Steps to reproduce

  1. Application repository contains a shared library as a Git submodule.
  2. Configure the submodule path under SonarCloud exclusions.
  3. Run analysis via Azure DevOps pipeline.
  4. Observe that files from the shared library are still included in the analysis.

Potential workaround

No workaround identified yet.

Question

Has anyone encountered a similar issue? Could you advise on the correct way to completely exclude a submodule/shared library project from SonarCloud analysis? Are there any additional configuration settings or scanner parameters that need to be configured?

Thanks in advance.

2

Hi @SuryaBhaskaraan. Welcome to the community.

Could you advise on the correct way to completely exclude a submodule/shared library project from SonarCloud analysis?

There’s nothing special about excluding submodules. You can exclude submodules the same way you exclude any directory.

I created console app with the following structure.

.
├── bin
│   └── Debug
├── console.csproj
├── Program.cs
└── shared
    ├── Class1.cs
    ├── obj
    └── shared.csproj

In the UI, I added shared/**/* to Project Settings > General Settings > Analysis Scope > Source File Exclusions.

image
image866×312 20.2 KB

Now, when I scan, I see Excluded sources: shared/**/* in the scanner logs.

15:12:19.162  INFO: Indexing files of module 'dotnet-test'
15:12:19.162  INFO:   Base dir: /home/austin/sonar/projects/dotnet-test/console
15:12:19.162  INFO:   Excluded sources: shared/**/*

And I can see that the scanner is excluding all files in /home/austin/sonar/projects/dotnet-test/console/shared/ (notice how excluded sources are relative to base dir).

15:12:21.747  INFO: Getting Filenames
15:12:21.748  INFO: Including file console.csproj
15:12:21.748  INFO: Including file obj/project.assets.json
15:12:21.748  INFO: Excluding file shared/obj/project.assets.json
15:12:21.748  INFO: Excluding file shared/shared.csproj

You can validate your own source exclusions by looking at the same log lines in your scanner logs.

Hope that helps. Let me know if you have any additional questions.

3

Hi Austin,

Thanks for the guidance.

I reviewed the scanner logs and found that the exclusion pattern is being picked up:

Excluded sources: /obj/, **/*.dll, **/Library, **/build-wrapper-dump.json

However, SonarCloud is still indexing and analyzing the shared library project:

Indexing files of module 'Integrations.Library’Base dir: D:\a\1\s\Library\src\Integrations.Library

The library is referenced via a ProjectReference and is a shared reusable project used across multiple applications.

What’s confusing is that we have the same setup across several projects that reference this shared library. In some projects the library does not appear to impact the analysis/LOC as expected, while in others it does, despite having the same overall structure and exclusion configuration.

Could you advise on the recommended way to exclude an entire referenced .NET project/module from analysis and LOC counting? Is there any additional configuration required beyond source file exclusions for projects referenced via ProjectReference?

Thanks

4

D:\a\1\s\Library\src\Integrations.Library doesn’t match any of the excluded patterns.

Replace **/Library with Library/** or **/Library/**.

5

Thanks for the help.

I checked the scanner logs and updated the exclusion pattern from:

**/Library

to:

**/Library/**

After rerunning the analysis, the shared library is now being excluded correctly and the issue is resolved.

It looks like the original pattern was not matching the files under the library path as intended.

Appreciate the guidance.