Git submodule support in PR analysis?

SonarQube
, ,
1

  • which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension)
    SonarQube Developer Edition 10.5.1.90531 inside docker
    SonarScanner CLI 6.0.0.4432
    SonarQube Scanner for JenkinsVersion2.17.2

  • what are you trying to achieve
    Project algo source code is located in a git submodule. Goal is to run SQ analysis on the integration repo (algo as submodule + specifics).

In a development branch, when the git submodule is updated, SQ analysis is not working as expected:

  • If running a branch analysis, submodule code is properly analyzed and shows in UI (although we see several git blame warnings in analysis log)

  • if running a PR analysis, submodule code is not analyzed and won’t show in UI, with a behavior similar to Pull Request analysis with submodules shows no issues

Details for PR analysis:

  • Analysis start and detects 1 change in the branch (probably the submodule pointer change)
SCM collecting changed files in the branch
Merge base sha1: 6b8c16d25e7512bab9fdd1cd7fccb01659916c5d
SCM collecting changed files in the branch (done) | time=65ms
SCM reported 1 file changed in the branch
  • Cache detects changes in 3 files of the submodule
INFO  37/40 files marked as unchanged
  • However, in the end, it states 0 files are modified
INFO SCM revision ID 'cddf0637450cac4a0f6efa35d7b47e20698ab45e'
INFO SCM writing changed lines
INFO Merge base sha1: 6b8c16d25e7512bab9fdd1cd7fccb01659916c5d
DEBUG SCM reported changed lines for 0 files in the branch

How can we properly tell scanner to consider the content of the submodule during PR analysis?

Note we don’t use shallow submodules

4

Hey there.

It’s on the list, and we know we have some work to do to:

  1. Make SonarCloud act like SonarQube and scan Git submodules
  2. For both, collect blame data so that it works “right” when considering new code, issue assignment, etc.

https://sonarsource.atlassian.net/browse/GFB-6

1 Like