How do you specify the sonarscanner version that is being used with SonarQubeAnalyze task?

[Andrei_Epure]

@Mike_Greco

When I use the SonarQubeAnalyze@5 task I notice that the scanner version is always

SonarScanner 4.7.0.2747

I want a newer version of the scanner to be used. Is there anyway to specify that or is that a deficiency of using these tasks ?

I want the " SonarScanner for .NET" which is 5.8.0 to be used. I shouldn’t have to download it and install it on the agent.

Hello @Mike_Greco

The SonarQube Extension for Azure DevOps contains the Scanner for .NET 5.8.0 , which has an embedded SonarScanner version 4.7.0.2747. You can read Introduction to the SonarQube/SonarCloud .NET analysis to get a better understanding of what each component does.

So: SonarQube Extension for Azure DevOps contains an embedded version of the Scanner for .NET, which contains an embedded version of SonarScanner. Each of these three components has its own version.

The logs in the Prepare Analysis Configuration step (SonarQubePrepare@5) will show:

SonarScanner for MSBuild 5.8

@Mike_Greco

The pages you replied with do not say how to update SonarQubeAnalyze@5 task to use a different version of the scanner.

This is not possible. The Scanner for .NET is embedded in the Azure Devops Extension. To update it, we need to release a new version of the AZDO Extension and publish it to the marketplace.

@Mike_Greco

So can the SonarQubeAnalyze@5 task be configured to use the 5.8.0 scanner ? and if so how can that be done please ?

As I mentioned, this is the currently embedded version (since the 5th of September 2022).

@Mike_Greco

And the example is completely wrong. Here’s why : the example clearly states you can “prepare, analyze, and publish” with the scanner mode as ‘MSBuild’ … but the moment you do that the follow error happens

Not really, the documentation says:

• Add a new Run Code Analysis task after your build task.

So between SonarQubePrepare and SonarQubePublish, you need to build and also to run the tests in order to have the code coverage report. See this example (SonarCloudPrepare and SonarQubePrepare are essentially the same steps).

Having said that, I do believe we can improve our existing documentation, as it is not clear from the YML example file what you need to fill in between SonarQubePrepare and SonarQubePublish. I will send this feedback to our documentation team.

Thank you for your feedback.