PR analysis shows issues outside changed lines when main branch is not recently analyzed

SonarQube Cloud
, ,
1

ALM used → GitHub

CI system → Azure DevOps

Scanner setup → SonarCloudPrepare@3 SonarCloudAnalyze@3

Languages of the repository: JS, TS

Steps to reproduce →

  1. A feature branch is created from main branch and a file is modified ( some lines are changed)
  2. The main branch has not been analyzed for several days (e.g., ~5 days)
  3. We run PR analysis using:

    • SonarCloudPrepare@3

    • SonarCloudAnalyze@3

Observed behavior

When running the PR analysis in this situation:

  • Sonar reports issues on lines that were not modified in the feature branch

  • In some cases, it appears to flag issues across the file, not just on changed code

Expected behavior

Sonar to report issues only on lines that were modified in the feature branch

Potential workaround:

  • Should we run Sonar analysis on every merge into main to ensure correct PR results?

  • Or is running analysis on main (e.g., nightly) considered sufficient?

Question

Is the observed behavior the expected one?

More specifically:

  1. Does PR analysis depend on the latest analysis snapshot of the target branch (main)?

  2. If the main branch has not been analyzed recently, can this lead to inaccurate “new code” detection in PRs?

  3. From a best practices perspective:

    • Should we run Sonar analysis on every merge into main to ensure correct PR results?

    • Or is running analysis on main (e.g., nightly) considered sufficient?

We are observing inconsistent PR analysis behavior and would like to clarify the expected behavior and recommended setup.

Goal

We want to ensure that:

  • PR analysis only reports issues introduced by the changes in the PR

  • We avoid false positives or noise caused by outdated baseline data

2

ALM used → GitHub

CI system → Azure DevOps

Scanner setup → SonarCloudPrepare@3 SonarCloudAnalyze@3

Languages of the repository: JS, TS

Steps to reproduce →

  1. A feature branch is created from main branch and a file is modified ( some lines are changed)

  2. The main branch has not been analyzed for several days (e.g., ~5 days)

  3. We run PR analysis using:

    • SonarCloudPrepare@3

    • SonarCloudAnalyze@3

Observed behavior

When running the PR analysis in this situation:

  • Sonar reports issues on lines that were not modified in the feature branch

  • In some cases, it appears to flag issues across the file, not just on changed code

Expected behavior

Sonar to report issues only on lines that were modified in the feature branch

Potential workaround:

  • Should we run Sonar analysis on every merge into main to ensure correct PR results?

  • Or is running analysis on main (e.g., nightly) considered sufficient?

Question

Is the observed behavior the expected one?

More specifically:

  1. Does PR analysis depend on the latest analysis snapshot of the target branch (main)?

  2. If the main branch has not been analyzed recently, can this lead to inaccurate “new code” detection in PRs?

  3. From a best practices perspective:

    • Should we run Sonar analysis on every merge into main to ensure correct PR results?

    • Or is running analysis on main (e.g., nightly) considered sufficient?

We are observing inconsistent PR analysis behavior and would like to clarify the expected behavior and recommended setup.

Goal

We want to ensure that:

  • PR analysis only reports issues introduced by the changes in the PR

  • We avoid false positives or noise caused by outdated baseline data

3

Hi,

Welcome to the community, all both of you.

I’ve merged your two identical posts with different usernames. Hopefully this was done in error.

Yes.

You should run analysis on every merge to main as a best practice, and because there are sometimes issues that PR analysis (with its limited scope) can’t find.

Yes.

 
HTH,
Ann

6

Thank you a lot for the response. For we will run sonarqube on the main branches every 3 hours to make sure we are up to date