So I’m new on my company, and I’m trying to integrate SonarCloud inside our CI / CD pipelines and our ALM GitHub. When I’m checking the repository, I see files like .sonarcloud.properties and sonar-project.properties already there, which means that someone tried some time ago to integrate Sonar into our code. I do see hardcoded the value sonar.projectVersion=3.5.0.2 on both sonar files.
While I’m implementing my custom script called pr_build.yaml inside .github/workflows/ folder, I do see the PR decoration reflected on my new PR, but somehow the analysis doesn’t check the new lines that I’m adding. Instead, it checks some lines that were added between today and last month (oldest line is from Dec 4th, 2022).
This is my pr_build.yaml file:
name: Pull Request
on:
pull_request:
types: [ opened ]
jobs:
sonarcloud:
name: PR Decoration
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: SonarCloud scan
uses: SonarSource/sonarcloud-github-action@master
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
with:
args: >
-Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
-Dsonar.pullrequest.branch=${{ github.event.pull_request.head.ref }}
-Dsonar.pullrequest.base=${{ github.event.pull_request.base.ref }}
-Dsonar.pullrequest.provider=GitHub
I do see reflected the following parameters on the github workflow execution:
Dsonar.pullrequest.key=1657 -Dsonar.pullrequest.branch=ENG-1002-Implement_automated_backend_testing_in_SonarQube -Dsonar.pullrequest.base=develop -Dsonar.pullrequest.provider=GitHub
Here are my sonar-project.properties:
sonar.projectKey=trip_ninja_api
sonar.organization=trip-ninja-inc-1
sonar.python.version=3.8
sonar.scm.revision=git
sonar.qualitygate.wait=true
.sonarcloud.properties:
# Path to sources
sonar.sources=.
sonar.python.version=3.8
sonar.scm.revision=git
I have a separate build.yaml for my complete analysis through AWS CodePipeline:
name: Build
on:
push:
branches:
- develop
jobs:
sonarcloud:
name: SonarCloud
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
- name: SonarCloud Scan
uses: SonarSource/sonarcloud-github-action@master
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
It’s important to remark that all these files are on a branch which I cut off from develop to work on the implementation. On develop branch, there’s no .github/workflows folder nor build scripts, and this is what sonar properties contain:
sonar-project.properties
sonar.organization=trip-ninja-inc
sonar.projectKey=trip-ninja-inc_trip_ninja_api
sonar.host.url=https://sonarcloud.io
sonar.login=XXXXX
sonar.sources=.
sonar.projectVersion=3.7.0
.sonarcloud.properties:
# Path to sources
sonar.sources=.
sonar.projectVersion=3.5.0.2
The analysis of complete code works fine inside our CI / CD pipeline in AWS CodePipeline, but while trying to scan only new code it’s when I’m facing issues. My main branch is being set as “develop”
- ALM used: GitHub
- CI system used: AWS CodePipeline
- Scanner command used when applicable (private details masked)
- Languages of the repository: Python
