Hello
sonarqube 7.0 community version is used. How do the new rules announced?
Are they added when we update the plugins to the newest version? At 30.07.2018 we upgraded the css plugin (sonar-css-plugin-1.0.1.508.jar) and today developers came across the critical bug which is said to be available since 19.07.2018. ( Selectors of lower specificity should come before overriding selectors of higher specificity)
When I checked 1.0.1.508 at github I see that is is released on Jul 27.
In Short my questions are
when and how are new rules added to our sonarqube instance?
Ä°f with new plugins, what does âavailable sinceâ mean, it does not seem to be related with plugin release date.
New rules are (often) added when analyzer plugins are upgraded, either through platform upgrades or individual plugin upgrades. It should never be a surprise.
That being said, if you donât want new rules to automatically be added to your quality profiles, you shouldnât be using the built-in Sonar Way quality profiles when analyzing code. Itâs a best practice to copy the built-in Sonar Way profiles, set those as default and start refining based on what is useful to your team/organization (and you can even do a diff on the built-in Sonar Way after analyzer plugin upgrades to see how youâre tracking against Sonarâs evolving defaults). Checkout this documentation about Quality Profiles.
You can check the release notes on analyzer plugins to discover new rules (and read about enhancements / bug fixes). These release notes are always linked in the Marketplace on your instance.
On your second point, between SCM information and how SonarQube tracks file lines, issues can be backdated to when the issue first appeared in the code, rather than when SonarQube first knew about the issue. This is really useful for not polluting the leak period with old issues related to new rules; a feature, not a bug!
Hi Colin
Thank you for the answers. I am confused about your answer about the second point:
As you see 8.1 k issues seem to occur in both overview and activities tab in following pictures and also in the first png it is said to be created 3 days ago with the last analysis , so why did not it incure in august 15th full analysis, since the plugin is first uploaded in 19.07.2018 , do you think ânot polluting the leak period featureâ worked here ? I am not sure because all the css:S4664 violations incurred on sep 13 not on the aug 15th.
today developers came across the critical bug which is said to be available since 19.07.2018
The rule description states when the rule was first available on the quality profile, but the âissue creationâ date should be when the issue first appeared in the code (or more accurately, when the code was first scanned).
Is any of this CSS new code that wouldnât have been scanned in the August 15th scan? Did any inclusion/exclusion patterns change since the August 15th scan?
Hi Colin,
thank you for your points.
I checked the jenkins job: sonar full analysis pipeline, no difference in exclusion list between two builds. On the bitbucket side, the css code never changed after initial commit: 22 Feb 2018 .
Maybe if i provide the job logs, you can observe something which I could not.
I also do not know the meaning of info log at jenkins builds: âsrc/main/webapp/assets/cms/assets/css/help.cssâ generating issue exclusions
The files are attached. the named file (SonarScannerJenkinsJobLog_Aug_15_2018.txt)
did not detected the css issue but the other did as issue
Thank you for your help.
Note that weâve gotten to the state documented in this MMF gradually. My Jira-fu is failing me at the moment, but itâs possible some of the backdating improvements were made after 7.0 (7.3 is the current version).
In terms of learning that new rules are available, there are several mechanisms for this in addition to what Colin mentioned. Specifically, thereâs a sidebar on the profiles page that lists some of the most recently added rules, as well as an email notification that can go out (off by default) to quality profile administrators when built-in profiles are updated (this can only be done by a plugin upgrade, so this pretty much means the added rules are new). And finally, you can do an âAvailable Sinceâ search on the rules page.
Regarding your new-old issues, without more details it will be hard to diagnose why they appeared suddenly.
