Populating sonar.java.libraries

SonarQube Cloud
1
  • ALM: Bitbucket Cloud
  • CI system: Bitbucket Pipelines
  • Scanner command: - pipe: sonarsource/sonarcloud-scan:2.0.0
  • Languages: scala, java

We have a large number of dependencies that are kept in the coursier cache. What’s the best way to populate the sonar.java.libs setting with these dependencies? Do I have to create an explicit comma-separated list of all of them? Or do I just include the entire cache directory? If I include the whole directory, we’ll probably also be tracking test and dev dependencies, which would be better to omit.

The cache is configured as follows on bitbucket-pipeline.yml:

  caches:
    coursier: ~/.cache/coursier/v1

This is what I am getting when I configure it using the following:
-Dsonar.java.libraries=~/.cache/coursier/v1/**/*.jar

INFO: ------------------------------------------------------------------------
INFO: EXECUTION FAILURE
INFO: ------------------------------------------------------------------------
INFO: Total time: 18.591s
INFO: Final Memory: 21M/88M
INFO: ------------------------------------------------------------------------
ERROR: Error during SonarScanner execution
java.lang.IllegalStateException: No files nor directories matching '~/.cache/coursier/v1/**/*.jar'

I get the same result if i just give it the directory: ~/.cache/coursier/v1

I am sure that the directory and the jar files are there on the pipeline build instance, but the sonar scanner doesn’t see it. Why?

2

Hey @Alvaro_Carrasco

We highly suggest using the SonarScanner for Maven or SonarScanner for Gradle if you’re using either of those build systems to build your Java code (which covers most Java projects).

As noted in the pipe:

NOTE: For projects using Maven or Gradle please execute a respective scanner directly instead of using this pipe (see examples).

This automatically configures properties like sonar.java.libraries. At the very least, running it this way once will let you browse what the scanner sets for these properties by checking the background task > Show SonarScanner Context.

3

We are not using maven or gradle. We’re using sbt.

4

I’ve never tried this out (it’s third-party) but this sbt plugin appears to set some useful default parameters.

Following parameters have default value provided by plugin.

  "sonar.host.url"
  "sonar.projectKey"
  "sonar.projectVersion"
  "sonar.sources"
  "sonar.java.binaries"
  "sonar.java.test.binaries"
  "sonar.java.libraries"
  "sonar.java.test.libraries"

It might be interesting just to see how it sets sonar.java.libraries