I’m trying to set up importing generic issues report with sonar scanner for dotnet via specifying /d:sonar.externalIssuesReportPaths=“…” option. There are however two issues I’m currently facing, one of which is a blocker and second one is an odd behavior of the scanner.
Problem 1 (blocker):
Scanner is processing the generic issues json files but failes to import issues claimig those are being ingnored for unknown file even though this file is present on disk. I.e.
15:00:49.780 DEBUG: Importing issues from ‘dependency-issues.json’
15:00:49.812 INFO: Imported 0 issues in 0 files
15:00:49.813 INFO: External issues ignored for 1 unknown files, including: SonarNetTest/Program.cs
I have created a minimalistiс dotnet project reproducing this behavior: there is a hardcoded dependency-issues.json report with single issue in definitely existing file Program.cs. I’ve tried playing with the filepath in json report but no luck: ./SonarNetTest/Program.cs, /SonarNetTest/Program.cs, SonarNetTest/Program.cs do not help issues to be recognised, to me it looks like a bug in scanner. There is an scan.sh file in the zip example where you can find /d:sonar.externalIssuesReportPaths=“dependency-issues.json” option specified correctly.
SonarNetTest.zip (569.1 KB)
Problem 2 (odd behavour):
When I specify /d:sonar.externalIssuesReportPaths=“dependency-issues.json” option, scanner fails to process the report unless dependency-issues.json is present not only in the solution root, but also in each prohect subfilder, so I have to plae a dummy empty dependency-issues.json in each subfolder (i.e. {solution root}/SonarNetTest/dependency-issues.json) for scanner to work. Otherwise it fails with java exception clearly seeking for a report in subfolder which also looks like a bug with workaroud to me:
15:30:04.763 ERROR: Error during SonarScanner Engine execution
java.lang.IllegalStateException: Failed to read external issues report ‘/mnt/c/Users/shabanov/RiderProjects/SonarNetTest/SonarNetTest/dependency-issues.json’
at org.sonar.scanner.externalissue.ExternalIssueReportParser.parse(ExternalIssueReportParser.java:47)
at org.sonar.scanner.externalissue.ExternalIssuesImportSensor.execute(ExternalIssuesImportSensor.java:73)
at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse(AbstractSensorWrapper.java:69)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:88)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.lambda$execute$1(ModuleSensorsExecutor.java:61)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.withModuleStrategy(ModuleSensorsExecutor.java:79)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:61)
at org.sonar.scanner.scan.SpringModuleScanContainer.doAfterStart(SpringModuleScanContainer.java:90)
at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:216)
at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:195)
at org.sonar.scanner.scan.SpringProjectScanContainer.scan(SpringProjectScanContainer.java:228)
at org.sonar.scanner.scan.SpringProjectScanContainer.scanRecursively(SpringProjectScanContainer.java:224)
at org.sonar.scanner.scan.SpringProjectScanContainer.scanRecursively(SpringProjectScanContainer.java:221)
at org.sonar.scanner.scan.SpringProjectScanContainer.doAfterStart(SpringProjectScanContainer.java:194)
at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:216)
at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:195)
at org.sonar.scanner.bootstrap.SpringScannerContainer.doAfterStart(SpringScannerContainer.java:372)
at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:216)
at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:195)
at org.sonar.scanner.bootstrap.SpringGlobalContainer.doAfterStart(SpringGlobalContainer.java:149)
at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:216)
at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:195)
at org.sonar.scanner.bootstrap.ScannerMain.runScannerEngine(ScannerMain.java:157)
at org.sonar.scanner.bootstrap.ScannerMain.run(ScannerMain.java:72)
at org.sonar.scanner.bootstrap.ScannerMain.main(ScannerMain.java:56)
Caused by: java.nio.file.NoSuchFileException: /mnt/c/Users/shabanov/RiderProjects/SonarNetTest/SonarNetTest/dependency-issues.json
at java.base/sun.nio.fs.UnixException.translateToIOException(Unknown Source)
at java.base/sun.nio.fs.UnixException.rethrowAsIOException(Unknown Source)
at java.base/sun.nio.fs.UnixException.rethrowAsIOException(Unknown Source)
at java.base/sun.nio.fs.UnixFileSystemProvider.newByteChannel(Unknown Source)
at java.base/java.nio.file.Files.newByteChannel(Unknown Source)
at java.base/java.nio.file.Files.newByteChannel(Unknown Source)
at java.base/java.nio.file.spi.FileSystemProvider.newInputStream(Unknown Source)
at java.base/java.nio.file.Files.newInputStream(Unknown Source)
at java.base/java.nio.file.Files.newBufferedReader(Unknown Source)
at org.sonar.scanner.externalissue.ExternalIssueReportParser.parse(ExternalIssueReportParser.java:42)
… 24 common frames omitted
My set up is the following:
- SonarQube Community Build v26.xxx (tried several minor version but the problem seems to be on scanner side)
- dotnet-sonarscanner v11.2.1
Would be happy if those bugs are confirmed and fixed, or some guidance on what I’m doing wrong here if I am.