Using Azure DevOps repository with changes to .cs files. When a Pull Request (PR) was created and the gated pipeline was run there were a number of issues (197) were highlighted with comments in the PR that relate to SonarCloud analysis.
However, a lot of those issues were on unrelated parts of the code that hasn’t changed. A couple issues were correctly highlighted with the changed lines of code, these will be corrected. The extra unrelated issues are too many in a single PR to address when they are nothing to do with the required changes in the PR
Even though these issues are valid, no code change occurred near these extra issues. Why have these issues been highlighted with this PR?
Some of these issues are file global issues, like file having too many lines, these are understood and will be dealt with, but others are just specific code issues that don’t need to be addressed at this time.
This is the changed code in a csharp file, this issue will be resolved:
The issues you’ve shown are actually classic examples of new issues legitimately raised in old code. Presumably the only uses of InvalidLegalFee were deleted in the PR.
That said, I’m a bit surprised that you’re seeing these in a PR, which typically only reports issues on changed code. Are you sure this is a PR analysis and not a short-lived branch?
I was not responsible for this change as I am implementing the enforcement of SonarCloud across the project within the company and not the development.
Yes these are from a PR, there were over 190 comments put on the PR from SonarCloud that related to non changed lines of code. I only gave examples of 2 types of PR comments, but there were many more. The developer responsible has for now resolved these comments in the PR with “Won’t fix” resolution so work can be completed without delay, which will do for now, but I need to understand why these comments have turned up and how to quieten them down as this will interfere with the progress of work on projects.
Typically when you see issues on old code reported in a pull request, it’s because there was a problem reading the SCM data, which is how analysis determines what’s new. Either that, or the branch being targeted by the PR wasn’t available in the local repository.
If you check the bottom of your analysis log, do you see a message about SCM detection being disabled? Or do you see “shallow clone detected”? If so, that (shallow cloning) should be disabled, typically by setting fetch-depth: 0.
I’ve looked at the analysis report (I believe this is the output produced by the yaml task SonarCloudAnalyse@1) and can not find the text “SCM” or “shallow”. Am I looking in the right place?
I have looked at the pipeline and it has set the shallow clone to false, I also tested changing shallow clone to true and I received an warning, so the build was on a non-shallow git clone.
These are the references to “SCM” in the log:
The analysis / scanner log is what’s output from the analysis command. Hopefully, the log you provide - redacted as necessary - will include that command as well.
From the link you provided above I can’t identify the log location other than what is produced the Azure Devops pipeline that utilises the SonarCloudAnalyze@1 task.
This is the log produce, is this what you want? SonarCloudLogs.txt (46.6 KB)
As the PR has been completed I am unable to reproduce the issue unless I do some work to replicate the problem on test Azure DevOps project.
Specifically, you simply shouldn’t see issues reported on lines that don’t have a blue highlight in PR analysis, so I’d like to double-confirm that that’s what we’re dealing with.
Thanks for jumping through my hoops. I have no clue why you’re seeing these issues in code that analysis doesn’t mark as new in the PR. I’m going to flag this for more expert eyes.
Could you share how you define the Azure pipeline YAML file? This looks like some configuration issue, though I need more information from you to investigate.
We use a template yaml file called from many projects to perform the PR build validation. gated-originations.yml.txt (3.1 KB) (renamed with .txt to allow upload)
- task: SonarCloudPrepare@1
inputs:
SonarCloud: "SonarCloud_DPRGroupLtd"
organization: "dprgroupltd"
scannerMode: "MSBuild"
projectKey: "$(SonarProjectKey)"
projectName: $(System.TeamProject) - ${{ parameters.SolutionName }}
extraProperties: |
# Additional properties that will be passed to the scanner
sonar.scm.provider=git
sonar.cs.vstest.reportsPaths=$(Agent.TempDirectory)\TestResults\*.trx
sonar.projectBaseDir=$(Build.Repository.LocalPath)
I’ve investigated a bit your issue and it raised two questions:
Is it correct that target branch of this PR is master?
I’ve noticed in your scanner logs that your project is not bound to Azure Devops, is there any reason to do so? Could you try to fix this and analyze PR again?
