We are using Sonarqube developer edition version 9.8.0.63668 to scan CXX project using Jenkins and SonarScanner
In our case sonarqube does 2 scans on each PR (PR scan and full branch scan) to prevent merging unexpected issues into master.
We have created PR where changed only 2 python scripts. During full branch scan, Sonarqube found 6 new bugs in C++ code. No C++ code was changed in this branch.
Are these new issues found in the master branch and categorized as old issues?
For branch analysis, new issues aren’t necessarily about changed code. Every branch has a new code definition setting that you can set.
My first guess is that your master branch has a different new code setting than your feature branch. You can check that in the Project Settings.
As I see in New Code settings, there are default general setting for all branches. There is no settings difference between master branch and other branches of project.
Branch was created from master. Changes are only in python code. So C++ code is the same for both branches.
Analysis scope is the same for all branches in our project.
@KovalovVladislav, does this python file impact the build configuration in any way? For example, if you have a custom-build system written in python.
If not, the only way to move forward is to generate two CFamily reproducers for the source file with different results. One from the master and the other from the branch.
To generate the reproducer file:
Search in the analysis log for the full path of the source file for which you want to create a reproducer (for instance, a file that contains a false-positive). You will have to use exactly this name (same case, / or \…)
Add the reproducer option to the scanner configuration:
sonar.cfamily.reproducer=“Full path to the .cpp”
Re-run the scanner to generate a file named sonar-cfamily.reproducer in the project folder.
Please share this file. If you think this file contains private information, let us know, and we’ll send you a private message that will allow you to send it privately.
@Abbas through a lot of pain I successfully found this issue in master) It was marked as False-Positive. Why this issue resolution was not migrated to another branch when it was created? And how we can avoid this in the future?
We already have faced with cases when issue was found in development branch, marked as resolved and resolution was not migrated to master. But reversed case happened first time.
I think it was marked ar false positive after the creation of that branch.
Also, for branches that are based on master, you should consider changing the new code definition to reference branch(master). This way you focus on the introduced issues. And the status of the branch issues will be propagated once the feature branch is merged.
