Hi @ganncamp and thanks for your reply,
I have compared the sonar analysis output from this particular project against another project (a different microservice) where it is working fine. I did not find anything that looks unusual. Here is the analysis log:
[INFO] User cache: /home/AzDevOps/.sonar/cache
2022-03-09T11:25:33.5816264Z [INFO] SonarQube version: 9.3.0
2022-03-09T11:25:33.6023021Z [INFO] Default locale: "en", source code encoding: "UTF-8"
2022-03-09T11:25:34.0972468Z [INFO] Load global settings
2022-03-09T11:25:34.3353343Z [INFO] Load global settings (done) | time=240ms
2022-03-09T11:25:34.3434943Z [INFO] Server id: B6199E94-AXmj4lZU2aX6gFbtAvlF
2022-03-09T11:25:34.3527196Z [INFO] User cache: /home/AzDevOps/.sonar/cache
2022-03-09T11:25:34.3562789Z [INFO] Load/download plugins
2022-03-09T11:25:34.3563599Z [INFO] Load plugins index
2022-03-09T11:25:34.4472134Z [INFO] Load plugins index (done) | time=90ms
2022-03-09T11:25:34.6374935Z [INFO] Load/download plugins (done) | time=281ms
2022-03-09T11:25:34.8305211Z [INFO] Loaded core extensions: developer-scanner
2022-03-09T11:25:35.3336112Z [INFO] Process project properties
2022-03-09T11:25:35.3440478Z [INFO] Process project properties (done) | time=10ms
2022-03-09T11:25:35.3444270Z [INFO] Execute project builders
2022-03-09T11:25:35.3464028Z [INFO] Execute project builders (done) | time=2ms
2022-03-09T11:25:35.3486480Z [INFO] Project key: gateway
2022-03-09T11:25:35.3491303Z [INFO] Base dir: /agent/_work/2/s
2022-03-09T11:25:35.3492345Z [INFO] Working dir: /agent/_work/2/s/target/sonar
2022-03-09T11:25:35.3637648Z [INFO] Load project settings for component key: 'gateway'
2022-03-09T11:25:35.4146210Z [INFO] Load project settings for component key: 'gateway' (done) | time=46ms
2022-03-09T11:25:35.5128912Z [INFO] Load project branches
2022-03-09T11:25:35.5543823Z [INFO] Load project branches (done) | time=40ms
2022-03-09T11:25:35.5555075Z [INFO] Load project pull requests
2022-03-09T11:25:35.5949271Z [INFO] Load project pull requests (done) | time=39ms
2022-03-09T11:25:35.5951239Z [INFO] Load branch configuration
2022-03-09T11:25:35.5960097Z [INFO] Found manual configuration of branch/PR analysis. Skipping automatic configuration.
2022-03-09T11:25:35.5975279Z [INFO] Load branch configuration (done) | time=3ms
2022-03-09T11:25:35.6556066Z [INFO] Auto-configuring with CI 'Azure DevOps'
2022-03-09T11:25:35.6573839Z [INFO] Load quality profiles
2022-03-09T11:25:35.7840203Z [INFO] Load quality profiles (done) | time=126ms
2022-03-09T11:25:35.7877416Z [INFO] Auto-configuring with CI 'Azure DevOps'
2022-03-09T11:25:35.7887275Z [INFO] Load active rules
2022-03-09T11:25:38.0839398Z [INFO] Load active rules (done) | time=2295ms
2022-03-09T11:25:38.1282168Z [INFO] Branch name: test/sonar-master
2022-03-09T11:25:38.1900120Z [INFO] Indexing files...
2022-03-09T11:25:38.1906217Z [INFO] Project configuration:
2022-03-09T11:25:38.1959465Z [INFO] Excluded sources: src/main/webapp/content/**/*.*, src/main/webapp/i18n/*.js, src/main/webapp/app/**/*.module.ts, src/main/webapp/app/**/*.route.ts, src/main/webapp/app/**/*.main.ts, src/main/webapp/app/**/*.model.ts, src/main/webapp/app/**/polyfills.ts, src/main/webapp/app/custom-polyfills/closest-polyfill.js, src/main/webapp/app/**/vendor.ts, src/main/webapp/app/**/*.config.ts, src/main/webapp/app/admin/**/*.*, src/main/webapp/app/layouts/profiles/**/*.*, src/main/java/uk/co/metrobank/crga/crgagateway/config/**/*.*, src/main/java/uk/co/metrobank/crga/crgagateway/web/rest/errors/**/*.*, target/classes/static/**/*.*, src/main/java/uk/co/metrobank/crga/crgagateway/aop/logging/**/*.*, src/main/java/uk/co/metrobank/crga/crgagateway/gateway/ratelimiting/**, src/main/java/uk/co/metrobank/crga/crgagateway/web/rest/EnvironmentResource.java, src/main/java/uk/co/metrobank/crga/crgagateway/security/CustomActiveDirectoryLdapAuthenticationProvider.java, src/main/java/uk/co/metrobank/crga/crgagateway/web/rest/util/EscapeUtils.java, src/main/webapp/app/local-modules/**
2022-03-09T11:25:39.5877681Z [INFO] 418 files indexed
2022-03-09T11:25:39.5884092Z [INFO] 176 files ignored because of inclusion/exclusion patterns
2022-03-09T11:25:39.5885736Z [INFO] 0 files ignored because of scm ignore settings
2022-03-09T11:25:39.5895237Z [INFO] Quality profile for css: Sonar way
2022-03-09T11:25:39.5900111Z [INFO] Quality profile for java: MetroBank Profile - Gold Standard
2022-03-09T11:25:39.5905214Z [INFO] Quality profile for js: Sonar way
2022-03-09T11:25:39.5906557Z [INFO] Quality profile for json: Sonar way
2022-03-09T11:25:39.5907907Z [INFO] Quality profile for ts: Sonar way
2022-03-09T11:25:39.5912165Z [INFO] Quality profile for web: Sonar way
2022-03-09T11:25:39.5913778Z [INFO] Quality profile for xml: Sonar way
2022-03-09T11:25:39.5916741Z [INFO] Quality profile for yaml: Sonar way
2022-03-09T11:25:39.5918800Z [INFO] ------------- Run sensors on module CRGA-crgagateway
2022-03-09T11:25:39.8016336Z [INFO] Load metrics repository
2022-03-09T11:25:39.8471749Z [INFO] Load metrics repository (done) | time=41ms
2022-03-09T11:25:42.7750270Z [INFO] Sensor JavaSensor [java]
2022-03-09T11:25:43.1522493Z [INFO] Configured Java source version (sonar.java.source): 8
2022-03-09T11:25:43.1583722Z [INFO] JavaClasspath initialization
2022-03-09T11:25:43.1692049Z [INFO] JavaClasspath initialization (done) | time=10ms
2022-03-09T11:25:43.1693982Z [INFO] JavaTestClasspath initialization
2022-03-09T11:25:43.1786761Z [INFO] JavaTestClasspath initialization (done) | time=9ms
2022-03-09T11:25:43.1907424Z [INFO] Java "Main" source files AST scan
2022-03-09T11:25:43.2099343Z [INFO] 31 source files to be analyzed
2022-03-09T11:25:43.3127859Z [INFO] Load project repositories
2022-03-09T11:25:43.3696587Z [INFO] Load project repositories (done) | time=57ms
2022-03-09T11:25:49.0048645Z [INFO] 31/31 source files have been analyzed
2022-03-09T11:25:49.0072557Z [INFO] Java "Main" source files AST scan (done) | time=5816ms
2022-03-09T11:25:49.0079931Z [INFO] Java "Test" source files AST scan
2022-03-09T11:25:49.0136960Z [INFO] 13 source files to be analyzed
2022-03-09T11:25:50.4523005Z [INFO] 13/13 source files have been analyzed
2022-03-09T11:25:50.4531755Z [INFO] Java "Test" source files AST scan (done) | time=1445ms
2022-03-09T11:25:50.4538449Z [INFO] No "Generated" source files to scan.
2022-03-09T11:25:50.4542101Z [INFO] Sensor JavaSensor [java] (done) | time=7680ms
2022-03-09T11:25:50.4545132Z [INFO] Sensor IaC CloudFormation Sensor [iac]
2022-03-09T11:25:50.5051150Z [INFO] 0 source files to be analyzed
2022-03-09T11:25:50.5243006Z [INFO] 0/0 source files have been analyzed
2022-03-09T11:25:50.5254175Z [INFO] Sensor IaC CloudFormation Sensor [iac] (done) | time=70ms
2022-03-09T11:25:50.5257551Z [INFO] Sensor C# Project Type Information [csharp]
2022-03-09T11:25:50.5273018Z [INFO] Sensor C# Project Type Information [csharp] (done) | time=1ms
2022-03-09T11:25:50.5277052Z [INFO] Sensor C# Analysis Log [csharp]
2022-03-09T11:25:50.5430504Z [INFO] Sensor C# Analysis Log [csharp] (done) | time=15ms
2022-03-09T11:25:50.5433321Z [INFO] Sensor C# Properties [csharp]
2022-03-09T11:25:50.5436342Z [INFO] Sensor C# Properties [csharp] (done) | time=1ms
2022-03-09T11:25:50.5439063Z [INFO] Sensor SurefireSensor [java]
2022-03-09T11:25:50.5459897Z [INFO] parsing [/agent/_work/2/s/target/test-results/test, /agent/_work/2/s/target/test-results/integrationTest]
2022-03-09T11:25:50.6677922Z [INFO] Sensor SurefireSensor [java] (done) | time=124ms
2022-03-09T11:25:50.6681298Z [INFO] Sensor HTML [web]
2022-03-09T11:25:51.3496312Z [INFO] Sensor HTML [web] (done) | time=681ms
2022-03-09T11:25:51.3499872Z [INFO] Sensor XML Sensor [xml]
2022-03-09T11:25:51.3522885Z [INFO] 4 source files to be analyzed
2022-03-09T11:25:51.6307509Z [INFO] 4/4 source files have been analyzed
2022-03-09T11:25:51.6330361Z [INFO] Sensor XML Sensor [xml] (done) | time=281ms
2022-03-09T11:25:51.6333171Z [INFO] Sensor Text Sensor [text]
2022-03-09T11:25:51.6429208Z [INFO] 396 source files to be analyzed
2022-03-09T11:25:51.9108702Z [INFO] 396/396 source files have been analyzed
2022-03-09T11:25:51.9114977Z [INFO] Sensor Text Sensor [text] (done) | time=278ms
2022-03-09T11:25:51.9117990Z [INFO] Sensor VB.NET Project Type Information [vbnet]
2022-03-09T11:25:51.9136164Z [INFO] Sensor VB.NET Project Type Information [vbnet] (done) | time=1ms
2022-03-09T11:25:51.9138887Z [INFO] Sensor VB.NET Analysis Log [vbnet]
2022-03-09T11:25:51.9291920Z [INFO] Sensor VB.NET Analysis Log [vbnet] (done) | time=15ms
2022-03-09T11:25:51.9297800Z [INFO] Sensor VB.NET Properties [vbnet]
2022-03-09T11:25:51.9299952Z [INFO] Sensor VB.NET Properties [vbnet] (done) | time=1ms
2022-03-09T11:25:51.9304419Z [INFO] Sensor JaCoCo XML Report Importer [jacoco]
2022-03-09T11:25:51.9362503Z [INFO] Importing 2 report(s). Turn your logs in debug mode in order to see the exhaustive list.
2022-03-09T11:25:52.0886044Z [INFO] Sensor JaCoCo XML Report Importer [jacoco] (done) | time=158ms
2022-03-09T11:25:52.0887280Z [INFO] Sensor JavaScript analysis [javascript]
2022-03-09T11:25:54.2373862Z [INFO] Deploying custom rules bundle jar:file:/home/AzDevOps/.sonar/cache/c8528df5e461867acf060f71702dbe39/sonar-securityjsfrontend-plugin.jar!/js-vulnerabilities-rules-1.0.0.tgz to /agent/_work/2/s/target/sonar/.sonartmp/eslint-bridge-bundle/package/custom-rules13995121962243394865
2022-03-09T11:25:56.3002086Z [INFO] 2 source files to be analyzed
2022-03-09T11:25:58.5516530Z [INFO] 2/2 source files have been analyzed
2022-03-09T11:25:58.5522984Z [INFO] Sensor JavaScript analysis [javascript] (done) | time=6463ms
2022-03-09T11:25:58.5525818Z [INFO] Sensor TypeScript analysis [javascript]
2022-03-09T11:25:59.5188279Z [INFO] Found 1 tsconfig.json file(s): [/agent/_work/2/s/tsconfig.json]
2022-03-09T11:25:59.5201111Z [INFO] Creating TypeScript program
2022-03-09T11:25:59.5205673Z [INFO] 242 source files to be analyzed
2022-03-09T11:25:59.5206637Z [INFO] TypeScript configuration file /agent/_work/2/s/tsconfig.json
2022-03-09T11:26:02.1048930Z [INFO] Creating TypeScript program (done) | time=2585ms
2022-03-09T11:26:02.1055075Z [INFO] Starting analysis with current program
2022-03-09T11:26:09.5215711Z [INFO] 65/242 files analyzed, current file: /agent/_work/2/s/src/main/webapp/app/entities/crgaslotting/slotted-exposure/property-delete/property-delete-dialog.component.ts
2022-03-09T11:26:18.4073140Z [INFO] Analyzed 242 file(s) with current program
2022-03-09T11:26:18.4104488Z [INFO] 242/242 source files have been analyzed
2022-03-09T11:26:18.4110990Z [INFO] Sensor TypeScript analysis [javascript] (done) | time=19859ms
2022-03-09T11:26:18.4113266Z [INFO] Sensor CSS Metrics [javascript]
2022-03-09T11:26:18.6721250Z [INFO] Sensor CSS Metrics [javascript] (done) | time=256ms
2022-03-09T11:26:18.6754242Z [INFO] Sensor CSS Rules [javascript]
2022-03-09T11:26:18.7225102Z [INFO] 82 source files to be analyzed
2022-03-09T11:26:19.9559277Z [INFO] 82/82 source files have been analyzed
2022-03-09T11:26:19.9562500Z [INFO] Sensor CSS Rules [javascript] (done) | time=1283ms
2022-03-09T11:26:19.9565485Z [INFO] Sensor ThymeLeaf template sensor [securityjavafrontend]
2022-03-09T11:26:20.1843368Z [INFO] Sensor ThymeLeaf template sensor [securityjavafrontend] (done) | time=227ms
2022-03-09T11:26:20.1844645Z [INFO] Sensor Serverless configuration file sensor [security]
2022-03-09T11:26:20.1863122Z [INFO] 0 Serverless function entries were found in the project
2022-03-09T11:26:20.1904267Z [INFO] 0 Serverless function handlers were kept as entrypoints
2022-03-09T11:26:20.1907359Z [INFO] Sensor Serverless configuration file sensor [security] (done) | time=6ms
2022-03-09T11:26:20.1910289Z [INFO] Sensor AWS SAM template file sensor [security]
2022-03-09T11:26:20.1965443Z [INFO] Sensor AWS SAM template file sensor [security] (done) | time=6ms
2022-03-09T11:26:20.1967934Z [INFO] Sensor Generic Test Executions Report
2022-03-09T11:26:20.1976650Z [INFO] Parsing /agent/_work/2/s/target/test-results/jest/TESTS-results-sonar.xml
2022-03-09T11:26:20.2269877Z [INFO] Imported test execution data for 98 files
2022-03-09T11:26:20.2273712Z [INFO] Sensor Generic Test Executions Report (done) | time=30ms
2022-03-09T11:26:20.2277166Z [INFO] Sensor JavaSecuritySensor [security]
2022-03-09T11:26:20.2295508Z [INFO] Reading type hierarchy from: /agent/_work/2/s/target/sonar/ucfg2/java
2022-03-09T11:26:20.3320211Z [INFO] Read 176 type definitions
2022-03-09T11:26:20.3406723Z [INFO] Reading UCFGs from: /agent/_work/2/s/target/sonar/ucfg2/java
2022-03-09T11:26:20.4491704Z [INFO] 11:26:20.447302 Building Runtime Type propagation graph
2022-03-09T11:26:20.4673896Z [INFO] 11:26:20.466639 Running Tarjan on 437 nodes
2022-03-09T11:26:20.4719456Z [INFO] 11:26:20.471243 Tarjan found 437 components
2022-03-09T11:26:20.4773247Z [INFO] 11:26:20.476595 Variable type analysis: done
2022-03-09T11:26:20.4824790Z [INFO] 11:26:20.481191 Building Runtime Type propagation graph
2022-03-09T11:26:20.4985839Z [INFO] 11:26:20.497973 Running Tarjan on 437 nodes
2022-03-09T11:26:20.5002290Z [INFO] 11:26:20.49975 Tarjan found 437 components
2022-03-09T11:26:20.5018731Z [INFO] 11:26:20.501388 Variable type analysis: done
2022-03-09T11:26:20.5036233Z [INFO] Analyzing 114 ucfgs to detect vulnerabilities.
2022-03-09T11:26:21.0008346Z [INFO] All rules entrypoints : 4
2022-03-09T11:26:21.0010499Z [INFO] Retained UCFGs : 26
2022-03-09T11:26:21.0163944Z [INFO] Taint analysis starting. Entrypoints: 4
2022-03-09T11:26:21.0167661Z [INFO] Running symbolic analysis for 'JAVA'
2022-03-09T11:26:21.2603211Z [INFO] Taint analysis: done.
2022-03-09T11:26:21.2604690Z [INFO] Sensor JavaSecuritySensor [security] (done) | time=1033ms
2022-03-09T11:26:21.2607848Z [INFO] Sensor CSharpSecuritySensor [security]
2022-03-09T11:26:21.2612642Z [INFO] Reading type hierarchy from: /agent/_work/2/s/target/ucfg_cs2
2022-03-09T11:26:21.2614407Z [INFO] Read 0 type definitions
2022-03-09T11:26:21.2618273Z [INFO] Reading UCFGs from: /agent/_work/2/s/target/ucfg_cs2
2022-03-09T11:26:21.2621550Z [INFO] No UCFGs have been included for analysis.
2022-03-09T11:26:21.2626072Z [INFO] Sensor CSharpSecuritySensor [security] (done) | time=1ms
2022-03-09T11:26:21.2628230Z [INFO] Sensor PhpSecuritySensor [security]
2022-03-09T11:26:21.2633723Z [INFO] Reading type hierarchy from: /agent/_work/2/s/target/sonar/ucfg2/php
2022-03-09T11:26:21.2635433Z [INFO] Read 0 type definitions
2022-03-09T11:26:21.2638880Z [INFO] Reading UCFGs from: /agent/_work/2/s/target/sonar/ucfg2/php
2022-03-09T11:26:21.2641748Z [INFO] No UCFGs have been included for analysis.
2022-03-09T11:26:21.2649397Z [INFO] Sensor PhpSecuritySensor [security] (done) | time=2ms
2022-03-09T11:26:21.2653171Z [INFO] Sensor PythonSecuritySensor [security]
2022-03-09T11:26:21.2658303Z [INFO] Reading type hierarchy from: /agent/_work/2/s/target/sonar/ucfg2/python
2022-03-09T11:26:21.2660959Z [INFO] Read 0 type definitions
2022-03-09T11:26:21.2666150Z [INFO] Reading UCFGs from: /agent/_work/2/s/target/sonar/ucfg2/python
2022-03-09T11:26:21.2669347Z [INFO] No UCFGs have been included for analysis.
2022-03-09T11:26:21.2672749Z [INFO] Sensor PythonSecuritySensor [security] (done) | time=2ms
2022-03-09T11:26:21.2676225Z [INFO] Sensor JsSecuritySensor [security]
2022-03-09T11:26:21.2680703Z [INFO] Reading type hierarchy from: /agent/_work/2/s/target/sonar/ucfg2/js
2022-03-09T11:26:21.2876406Z [INFO] Read 0 type definitions
2022-03-09T11:26:21.2880035Z [INFO] Reading UCFGs from: /agent/_work/2/s/target/sonar/ucfg2/js
2022-03-09T11:26:21.9286728Z [INFO] 11:26:21.92798 Building Runtime Type propagation graph
2022-03-09T11:26:22.0468563Z [INFO] 11:26:22.046107 Running Tarjan on 7892 nodes
2022-03-09T11:26:22.0593932Z [INFO] 11:26:22.058689 Tarjan found 7892 components
2022-03-09T11:26:22.0860749Z [INFO] 11:26:22.084404 Variable type analysis: done
2022-03-09T11:26:22.0865719Z [INFO] 11:26:22.084935 Building Runtime Type propagation graph
2022-03-09T11:26:22.1645334Z [INFO] 11:26:22.163739 Running Tarjan on 7892 nodes
2022-03-09T11:26:22.1759821Z [INFO] 11:26:22.175418 Tarjan found 7892 components
2022-03-09T11:26:22.2013516Z [INFO] 11:26:22.200489 Variable type analysis: done
2022-03-09T11:26:22.2029255Z [INFO] Analyzing 1205 ucfgs to detect vulnerabilities.
2022-03-09T11:26:23.2547254Z [INFO] Taint analysis starting. Entrypoints: 117
2022-03-09T11:26:23.2550135Z [INFO] Running symbolic analysis for 'JS'
2022-03-09T11:26:26.8277106Z [INFO] Taint analysis: done.
2022-03-09T11:26:26.8312409Z [INFO] Sensor JsSecuritySensor [security] (done) | time=5561ms
2022-03-09T11:26:26.8384371Z [INFO] ------------- Run sensors on project
2022-03-09T11:26:26.8624832Z [INFO] Sensor Zero Coverage Sensor
2022-03-09T11:26:26.8976828Z [INFO] Sensor Zero Coverage Sensor (done) | time=33ms
2022-03-09T11:26:26.8998259Z [INFO] Sensor Java CPD Block Indexer
2022-03-09T11:26:26.9702675Z [INFO] Sensor Java CPD Block Indexer (done) | time=69ms
2022-03-09T11:26:27.0590846Z [INFO] CPD Executor 32 files had no CPD blocks
2022-03-09T11:26:27.0621212Z [INFO] CPD Executor Calculating CPD for 173 files
2022-03-09T11:26:27.1951741Z [INFO] CPD Executor CPD calculation finished (done) | time=132ms
2022-03-09T11:26:27.3757784Z [INFO] Load New Code definition
2022-03-09T11:26:27.4153454Z [INFO] Load New Code definition (done) | time=39ms
2022-03-09T11:26:27.4459934Z [INFO] Analysis report generated in 221ms, dir size=2.9 MB
2022-03-09T11:26:28.2910266Z [INFO] Analysis report compressed in 844ms, zip size=1.2 MB
2022-03-09T11:26:28.5561079Z [INFO] Analysis report uploaded in 265ms
2022-03-09T11:26:28.5593561Z [INFO] ANALYSIS SUCCESSFUL, you can browse https://sonarqube-azure.zestyfox.com/dashboard?id=crgagateway&branch=test%2Fsonar-master
2022-03-09T11:26:28.5598446Z [INFO] Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
2022-03-09T11:26:28.5604170Z [INFO] More about the report processing at https://sonarqube-azure.zestyfox.com/api/ce/task?id=AX9ubixf_-e3dBHWs4NX
2022-03-09T11:26:34.1920984Z [INFO] Analysis total time: 59.361 s
2022-03-09T11:26:34.1937252Z [INFO] ------------------------------------------------------------------------
2022-03-09T11:26:34.1939127Z [INFO] BUILD SUCCESS
2022-03-09T11:26:34.1941420Z [INFO] ------------------------------------------------------------------------
2022-03-09T11:26:34.1943499Z [INFO] Total time: 13:17 min
2022-03-09T11:26:34.1951619Z [INFO] Finished at: 2022-03-09T11:26:34Z
2022-03-09T11:26:34.1952854Z [INFO] ------------------------------------------------------------------------
2022-03-09T11:26:34.5586459Z ##[section]Finishing: Run sonar
Here is the sonar-project.properties file if it matters:
sonar.projectKey=xxx
sonar.projectName=xxx
sonar.projectVersion=1.0
sonar.sources=src/main/
sonar.host.url=http://localhost:9001
sonar.tests=src/test/
sonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml,target/site/jacoco-it/jacoco.xml
sonar.java.codeCoveragePlugin=jacoco
sonar.junit.reportPaths=target/test-results/test,target/test-results/integrationTest
sonar.testExecutionReportPaths=target/test-results/jest/TESTS-results-sonar.xml
sonar.typescript.lcov.reportPaths=target/test-results/lcov.info
sonar.sourceEncoding=UTF-8
I have upgraded from Node 10 to Node 16.14, too. I would appreciate if you have any other ideas on how to debug this further?
Thank you!