Need guidance in configuring owasp dependency and jacoco in apache ant java project

[Katheeja_Yasmin]

Hi,

I have a java project which is using ant apache as a build tool.Am using sonarscanner in github actions to scan the project.I need detailed steps to be configured for enabling jacoco and owasp dependency check.
Sonarqube version -10.4

Project structure:
-.github/workflow file
-.3d
-build-tools
-doc
-keygen
-lib
|
-3dlib
-bin
-lib
-.jar (jar files)
-lib1
|
-.jar (jar files)
-src
|
-test
-.gitignore
-build.xml

Note : I have test folder inside src dir.

Below is my sonar-project.properties file.

sonar.projectKey=sample project
sonar.projectName=project name
sonar.projectVersion= not provided
sonar.sources=src
# sonar.tests=test
sonar.java.binaries=classes/
sonar.java.test.libraries=lib/*.jar
sonar.dynamicAnalysis=reuseReport
# sonar.junit.reportsPath=build/report
# sonar.jacoco.reportPath=build/report/jacoco.exec
sonar.java.libraries=lib/*.jar
sonar.java.coveragePlugin=jacoco
sonar.sourceEncoding=UTF-8
# sonar.verbose=true
sonar.core.codeCoveragePlugin=jacoco
# sonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml
sonar.coverage.jacoco.xmlReportPaths=classes/reports/jacoco.xml
# sonar.java.libraries=**/*.jar
sonar.dependencyCheck.htmlReportPath=target/dependency-check-report.html
sonar.dependencyCheck.jsonReportPath=target/dependency-check-report.json
sonar.dependencyCheck.reportPath=target/dependency-check-report.xml

I placed the jacoco-ant.jar and Junit-ant.jar files under my lib folder. Apart from this do i need to add any specific steps inside my build.xml file?

Sonar ui showing results only under duplication and security hotspot.I have a test file in place but coverage shows 0.and i dont see any results from owasp dependecy check as well.

I need assistance to fix this issue.

Thanks.

[Colin]

Hey there.

• For anything related to Dependency Check, you’ll need to raise an issue with them on GitHub. GitHub - dependency-check/dependency-check-sonar-plugin: Integrates Dependency-Check reports into SonarQube
• For JaCoCo, SonarQube is only involved in reading the report (it doesn’t care how it’s generated). The JaCoCo Ant tasks might help you. Do you have an XML JaCoCo report already being generated? If so, what do the logs say about importing it?

How to find logs about importing code coverage

When coverage data isn’t appearing as expected in SonarQube / SonarCloud, the first place you should look is the scanner logs. Where do I find the scanner logs? This will likely be broken out into its own guide soon The Scanner logs are the output of executing one of the scanners, either directly or wrapped by one of many integrations, such as the SonarScanner for Jenkins, SonarScanner for Azure DevOps, SonarQube/SonarCloud GitHub Actions or SonarQube / SonarCloud Bitbucket Pipes. …

[Katheeja_Yasmin]

Hi Colin,

Thanks for the response.But am just confused by seeing the jacoco page.could you please help me to configure what exact steps need to be added into my build.xml file to generate the coverage report.

and to add this i am seeing this log in my github actions .Please help me with the exact steps needs to be added in build.xml and sonar-project.properties file.

2024-06-10T14:58:38.7786380Z 14:58:38.735 INFO: No "Test" source files to scan.
2024-06-10T14:58:38.7787281Z 14:58:38.735 INFO: No "Generated" source files to scan.

2024-06-10T14:59:04.9763811Z 14:59:04.972 INFO: Sensor JaCoCo XML Report Importer [jacoco]
2024-06-10T14:59:04.9768379Z 14:59:04.974 WARN: No coverage report can be found with sonar.coverage.jacoco.xmlReportPaths='classes/reports/jacoco.xml'. Using default locations: target/site/jacoco/jacoco.xml,target/site/jacoco-it/jacoco.xml,build/reports/jacoco/test/jacocoTestReport.xml
2024-06-10T14:59:04.9779537Z 14:59:04.975 INFO: No report imported, no coverage information will be imported by JaCoCo XML Report Importer
2024-06-10T14:59:04.9781544Z 14:59:04.975 INFO: Sensor JaCoCo XML Report Importer [jacoco] (done) | time=3ms
2024-06-10T14:59:04.9763811Z 14:59:04.972 INFO: Sensor JaCoCo XML Report Importer [jacoco]
2024-06-10T14:59:04.9768379Z 14:59:04.974 WARN: No coverage report can be found with sonar.coverage.jacoco.xmlReportPaths='classes/reports/jacoco.xml'. Using default locations: target/site/jacoco/jacoco.xml,target/site/jacoco-it/jacoco.xml,build/reports/jacoco/test/jacocoTestReport.xml
2024-06-10T14:59:04.9779537Z 14:59:04.975 INFO: No report imported, no coverage information will be imported by JaCoCo XML Report Importer
2024-06-10T14:59:04.9781544Z 14:59:04.975 INFO: Sensor JaCoCo XML Report Importer [jacoco] (done) | time=3ms 

[Colin]

Hi,

You may find that some other community member has advice for running JaCoCo from Ant, but this topic is out of scope for this community, so please don’t be surprised if no one has a helpful answer. SonarQube just reads the report, it isn’t involved in generating it.