I have installed the latest version of SonarQube Community EditionVersion 10.3 (build 82913) in a docker container. It is integrated with the self-hosted GitLab DevOps Platform.
As a first step I imported a project from GitLab. Then as described on the project Configure Analysis method GitLab CI, added below properties to the pom.xml file.
stages:
- sonarqube-check
sonarqube-check:
stage: sonarqube-check
image: maven:3-eclipse-temurin-17
variables:
SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar" # Defines the location of the analysis task cache
GIT_DEPTH: "0" # Tells git to fetch all the branches of the project, required by the analysis task
cache:
key: "${CI_JOB_NAME}"
paths:
- .sonar/cache
script:
- mvn verify sonar:sonar
allow_failure: true
only:
- merge_requests
- main
When GitLab CI executes the build job it fails with the below error.
[ERROR] Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.10.0.2594:sonar (default-cli) on project shabdkosh: Project 'my_project_key' can't have 2 modules with the following key: my_project_key -> [Help 1]
Looks like SonarQube is trying to create another project rather than using the one that is already created with key my_project_key.
I removed the <sonar.projectKey> property from the pom.xml and ran the CI job again. This time the job ran successfully and created a new project with key "groupId:artifactId" as defined in the pom.xml. Then ran the CI job once more and it again completed successfully updating the project’s analysis results.
Then I updated the <sonar.projectKey> property value as "groupId:artifactId" in the pom.xml. The subsequent CI job fails with the same error.
Failed to execute goal sonar-maven-plugin (default-cli) on project can't have 2 modules with the following key
Looks like property <sonar.projectKey> must be avoided in the pom.xml for Maven projects.
This is contrary to the configuration instructions mentioned on the project home page.
The analysis / scanner log is what’s output from the analysis command. Hopefully, the log you provide - redacted as necessary - will include that command as well.
Most probably the token that you are using does not have permission to analyse the project. Check the token details at /account/security URL of your sonarqube installation.
You may create a token either specifically for the project or a global one. The global token will have permission on all projects.
When you analyze without explicitly specifying sonar.projectKey, then a [group_id]:[project_id] key is automatically formed. I see that when you specify a project key manually, you use shabdkosh. So I need to ask: is there a module (or some other component) in your project with that same name?
Sonar analysis is run against this pom. If I remove <sonar.projectKey>bharat.amarkosh:shabdkosh</sonar.projectKey> from the pom.xml then analysis works fine.
Thank you for bringing up this issue. I was able to reproduce the problem and there is indeed a bug in the Scanner for Maven. You can track the progress on [MSONAR-205] - Jira.
At the moment the problem happens when sonar.projectKey is defined in the root pom, or when passed as a user property, i.e. -Dsonar.projectKey. I would suggest you to not set the property in the cases mentioned above. As mentioned in the documentation the scanner will populate the property from the groupId and the artifactId.
It seems that the property can be set in the sub-modules, just make sure that each sub-module has a different value!