Need help with pull request decorating view

Hi,
I’m using SonarQube Developer edition 8.4 and integrate it to self managed Gitlab instance.

So I need help with pull request decorating. In comment in my Gitlab I see analyse result of changed files. It’s almost always empty.


But I wanna see analyse of all files in merge request result(of all sources in target branch after merge). Because there actually are problems.

How can I get it?

1 Like

Hi @riu.daineko

Welcome to the Community :smiley:

A SonarQube analysis of a PR is, by definition, only the new code – only the code you want to merge. Once you’ve performed the merge, you can analyze the target branch using branch analysis to get the full picture, but this can’t be done as part of the PR analysis.

I hope this clarifies; let me know if you need more details.

Regards,

Cameron.

Hi, Cameron!

Look at this.

This PR has a critical vulnerability that found in source branch analyse

And that what I see in my PR decoration:

Is it ok in your opinion?

1 Like

BTW
Before we purchase a license we used sonar 7.6 community with plugin from GitHub. So there was a property sonar.gitlab.all_issues that cover my case. Don’t understand why github plugin works better then newest licensed instance.

1 Like

Hi @riu.daineko

Was this vulnerability already in the branch? Or was it introduced by the PR? That’s the critical question in understanding whether it should be found by PR analysis.

Regards,

Cameron.

Hi, @Cameron
Vulnerability introduced by the PR. It’s a gitlab merge request screenshot. Green background means new code addition.
image

Hi @riu.daineko,

Can you zip up the scanner-side logs from the scan of the MR and post them? Feel free to redact any sensitive data. Could you also post a screen shot of the vulnerability on that line of code as shown in the branch scan?

Regards,

Cameron.

Hi, @Cameron


scanner logs.zip (2.5 KB)