We are using SonarQube 8.9 LTS (an update to 9.9 is planned in the future but currently out of reach) and the Sonar Scanner CLI 4.7.0.2747.
In our current project, we use the CLI Scanner because we want to analyze both a Typescript/Node frontend and a Java/Gradle backend in the same Sonar project (and so using the Gradle Scanner directly to handle the configuration for us is not an option).
However, I am uncertain in a few cases about how to set up the configuration properties for the CLI scanner correctly:
-
sonar.sources
+sonar.tests
If I want my test code to show up for analysis in SonarQube, do I need include the paths to the test code insonar.sources
and then distinguish them from the main code by adding them tosonar.tests
? Or is it sufficient to only add the test code tosonar.tests
? (We are currently doing the latter, but I noticed that no tests show up in our SonarQube instance - unlike with other projects that use the Gradle Scanner).
-
sonar.java.libraries
+sonar.java.test.libraries
Basically a similar question as with the sources above: Should thesonar.java.test.libraries
include only the test libraries (such as JUnit) or is it okay if it also redundantly contains the full classpath that is already included insonar.java.libraries
?
Our configuration currently looks like this (trimmed to the properties I believe to be relevant for this issue), but we only see our main sources and no test sources in SonarQube:
# --- shared ---
sonar.sources=./my-project-client/src,./my-project-server/src/main/java,./my-project-server/src/main/resources
sonar.exclusions=**/*.spec.ts,**/src/assets/docs/**/*.html
sonar.tests=./my-project-client/src,./my-project-server/src/test/java
sonar.test.inclusions=./my-project-client/**/*.spec.ts,./my-project-server/**/*Test.java
# --- java ---
sonar.java.binaries=./my-project-server/build/classes/java/main
sonar.java.libraries={{SONAR_JAVA_LIBRARIES}}
sonar.java.test.binaries=./my-project-server/build/classes/java/test
sonar.java.test.libraries={{SONAR_JAVA_TEST_LIBRARIES}}
({{SONAR_JAVA_LIBRARIES}} and {{SONAR_JAVA_TEST_LIBRARIES}} are placeholders that get substituted with the actual resolved Gradle dependencies before executing the Sonar analysis in the CI build.)
Our CI build shows the following log output:
Indexing files...
Project configuration:
Excluded sources: **/generated/**/*.java, **/*.spec.ts, **/src/assets/docs/**/*.html, ./my-project-client/**/*.spec.ts, ./my-project-server/**/*Test.java
Included tests: ./my-project-client/**/*.spec.ts, ./my-project-server/**/*Test.java
The exclusion of **/generated/**/*.java
is from our global SonarQuble exclusion, but I don’t see why ./my-project-server/**/*Test.java
would show up in the excluded sources based on my configuration above.