I am currently experiencing the following issue with a large (50k+ lines of code) multi-language (Python, Java, Terraform) mono-repo project. I cannot seem to get the metrics to stay consistent and stop resetting after different quality profile scans are run. I do not have any custom quality profiles and instead am using sonar way for everything (I let SonarQube decide which to use). I am running the SonarQube scans from a GitHub action where I specifically mark Java, Python, and Terraform files for inclusion and pass all the necessary file paths for all micro-services into that GitHub action step (SonarSource/sonarqube-scan-action@v2). I am currently running Enterprise Edition Version 9.9.
Here is a graph of my code smells, vulnerabilities, etc. over time showing the intense variation toward the right side of the graph as we have started using SonarQube again:
This is a graph of when the system auto-chose to use the Java quality profile (~450 code smells):
This is a graph of when the system auto-chose to use the Terraform quality profile (~5 code smells):
All of this is not even mentioning the fact that Python code files are completely excluded from analysis when either of these profiles are used.
How do I get my project to scan Java, Python, and Terraform altogether without seemingly overwriting each others results in subsequent scans? Even the code in the “Code” tab changes based on Quality Profile. I am trying to get rid of these sort of disjointed jumpy graphs for tracking the metrics as well.
Any help or guidance on where to go from here would be greatly appreciated. Thank you in advance for your help.