Need help with pull request decorating view

riu.daineko · September 17, 2020, 12:39pm

Hi,
I’m using SonarQube Developer edition 8.4 and integrate it to self managed Gitlab instance.

So I need help with pull request decorating. In comment in my Gitlab I see analyse result of changed files. It’s almost always empty.

But I wanna see analyse of all files in merge request result(of all sources in target branch after merge). Because there actually are problems.

How can I get it?

Cameron · September 17, 2020, 2:02pm

Hi @riu.daineko

Welcome to the Community

A SonarQube analysis of a PR is, by definition, only the new code – only the code you want to merge. Once you’ve performed the merge, you can analyze the target branch using branch analysis to get the full picture, but this can’t be done as part of the PR analysis.

I hope this clarifies; let me know if you need more details.

Regards,

Cameron.

riu.daineko · September 18, 2020, 7:36am

Hi, Cameron!

Look at this.

This PR has a critical vulnerability that found in source branch analyse

And that what I see in my PR decoration:

Is it ok in your opinion?

riu.daineko · September 18, 2020, 7:54am

BTW
Before we purchase a license we used sonar 7.6 community with plugin from GitHub. So there was a property sonar.gitlab.all_issues that cover my case. Don’t understand why github plugin works better then newest licensed instance.

Cameron · September 21, 2020, 7:06am

Hi @riu.daineko

Was this vulnerability already in the branch? Or was it introduced by the PR? That’s the critical question in understanding whether it should be found by PR analysis.

Regards,

Cameron.

riu.daineko · September 21, 2020, 7:25am

Hi, @Cameron
Vulnerability introduced by the PR. It’s a gitlab merge request screenshot. Green background means new code addition.

Cameron · September 24, 2020, 3:52pm

Hi @riu.daineko,

Can you zip up the scanner-side logs from the scan of the MR and post them? Feel free to redact any sensitive data. Could you also post a screen shot of the vulnerability on that line of code as shown in the branch scan?

Regards,

Cameron.

riu.daineko · September 25, 2020, 12:01pm

Hi, @Cameron

scanner logs.zip (2.5 KB)

Cameron · October 5, 2020, 7:41am

Hi @riu.daineko,

Apologies for the delay on this. I’m seeing the following in your log file:

INFO: SCM collecting changed files in the branch
WARN: No merge base found between HEAD and refs/remotes/origin/master
INFO: SCM collecting changed files in the branch (done) | time=215ms

which makes me suspect you’re seeing something similar to this thread where (in a GitHub context rather than GitLab) SonarQube is not able to determine what are new files. To check this:

Can you go to the Code tab of the PR analysis in SonarQube and check the files there. Do you see consul.py?

Is there anything special about the way you’re configuring GitLabCI to check out your branches?

Regards,

Cameron.