PL/SQL Scan Shows Hotspots But No Security Issues or Code Coverage

[Colin]

Hey there.

@rjmo

1. Does SonarQube Developer Edition support Security Issues for PL/SQL, or only Hotspots?
2. What conditions or rules trigger Security Issues in PL/SQL?

Checking rules.sonarsource.com, there are 4 vulnerability rules for PL/SQL. Is your code designed to trigger any of them?

@rjmo

3. Is PL/SQL code coverage fully supported in Developer Edition using utPLSQL?
4. Is there a way to confirm whether the coverage.xml is being read and processed correctly?

SonarQube will support any coverage tool if the final report is formatted as generic coverage data. Refer to the following guide for troubleshooting (specifically, where to find the logs):

How to find logs about importing code coverage

When coverage data isn’t appearing as expected in SonarQube Server / Community Build or SonarQube Cloud, the first place you should look is the scanner logs. Where do I find the scanner logs? This will likely be broken out into its own guide soon The Scanner logs are the output of executing one of the scanners, either directly or wrapped by one of many integrations, such as the SonarScanner for Jenkins, SonarScanner for Azure DevOps, SonarQube/SonarCloud GitHub Actions or SonarQube /…