Hi,
I’m using SonarQube Developer edition 8.4 and integrate it to self managed Gitlab instance.
So I need help with pull request decorating. In comment in my Gitlab I see analyse result of changed files. It’s almost always empty.
Hi @riu.daineko
Welcome to the Community 
A SonarQube analysis of a PR is, by definition, only the new code – only the code you want to merge. Once you’ve performed the merge, you can analyze the target branch using branch analysis to get the full picture, but this can’t be done as part of the PR analysis.
I hope this clarifies; let me know if you need more details.
Regards,
Cameron.
Hi, Cameron!
Look at this.
This PR has a critical vulnerability that found in source branch analyse
And that what I see in my PR decoration:
Is it ok in your opinion?
BTW
Before we purchase a license we used sonar 7.6 community with plugin from GitHub. So there was a property sonar.gitlab.all_issues that cover my case. Don’t understand why github plugin works better then newest licensed instance.
Hi @riu.daineko
Was this vulnerability already in the branch? Or was it introduced by the PR? That’s the critical question in understanding whether it should be found by PR analysis.
Regards,
Cameron.
Hi, @Cameron
Vulnerability introduced by the PR. It’s a gitlab merge request screenshot. Green background means new code addition.
Hi @riu.daineko,
Can you zip up the scanner-side logs from the scan of the MR and post them? Feel free to redact any sensitive data. Could you also post a screen shot of the vulnerability on that line of code as shown in the branch scan?
Regards,
Cameron.
