In our company we are using YAML Azure DevOps build pipelines for around 100 projects in SonarQube.
This week, SonarQube extension for Azure DevOp got a major update to tasks version 7.
This is already the second major this year, as on 2024-05-31 the extension v 6.0.0 was released.
In the past, we had at least some years between major releases (2021-09-28 v 5.0.0, 2018-02-15 v4.0.0) .
In the pipeline, always three tasks are required: SonarQubePrepare@x, SonarQubeAnalyze@x and SonarQubePublish@x where x must be the same on all three tasks as otherwise the pipelines are failing.
As a result of a major update of the tasks (and deprecation/removing of previous ones), we have to touch each build pipelines in all active maintained branches to update the version x
of SonarQube tasks, especially on deprecation. This is error-prone and annoying for the colleagues.
My colleagures are complaining to me as key user and maintainer of our SonarQube installation
If I was product manager, my wishes would be:
- Keep the major stable of the extension used in the pipeline stable at least as long as the LTA of SonqrQube (around 18 months)
- Simplify the structure of the tasks. Why are three tasks necessary, SonarQubePublish is always used after SonarQubeAnalyze. Merged them to a new SonarQubeFinalize task, so that the pipelines get shorter and simpler. KISS.
- If a new build is analyzed the first time with a build from an AzureDevOps repo, set up the DevOps platform integration in SonarQube. Even if the
sonar.links.scm
property is set in SonarQube prepare, the DevOps integration need to be set manually in SonarQube by an administrator.