We have configured pull requests to display code quality on bitbucket. The pull request result shows findings older than 10 days even though the new code is defined to issues within 7 days.
The definition of New Code for a Pull Request is always “what changed between the source and target branch”. Any other definition of New Code is ignored.
Stated another way, the New Code Period only applies to long-lived branches.
Okay. However, the highlighted issues are older issues and not part of the current pull request. On sonarcloud it clearly states that it was found 11 days ago.
The pull request displays 19 issues on bitbucket widget.
I have gone through other PR requests and sonarcloud scans. My observation is that the sonarcloud scan displays all the issues found in the modified files, not just the modified code.
As shown in the above example, just 2 lines were modified on two files, but it displays all the issues within the two files.
By any chance, did the paths of the files change? SONAR-13579 was implemented in SonarQube, but not SonarCloud. If this is the case, it would be a great case to bring up the topic again with the team.
From my initial analysis, it looks like I might be confusing whole function with whole file. Or is it how sonarcloud scan for pull request is supposed to work?
I can see old issues in the same file that are in “Full Analysis” that are not raised in the pull request. But some of the issues raised in the pull request itself are not relevant to the lines changed in the pull request.
I won’t be able to share the examples here since the file contents might be sensitive.
Is it necessary that we install the dependencies and build the app before running the scan? As you can see in the bitbucket pipeline, we are not doing so at the moment. Does it effect the scan result?
At this point, it would make sense for you to attach DEBUG level scanner logs (you’re already passing -X in your pipeline, by the looks of it) for a PR where issues are being raised on unchanged lines.