Project-level Source File Exclusions not working while Global exclusions work

SonarQube Server / Community Build Writing rules
,
1

Hello,

We are using SonarQube Community Build 26.1.0.118079.

We are experiencing an issue where Source File Exclusions configured at the project level do not seem to be applied. However, the same exclusion pattern works correctly when configured under Global Source File Exclusions.

For example, we are using the following pattern:

**/Content/**

We performed the following tests:

  1. Administration → Analysis Scope → Global Source File Exclusions

With:

**/Content/**

files under the content directory are successfully excluded from the analysis.

  1. Administration → Analysis Scope → Source File Exclusions

When the same pattern is configured here, the files are still analyzed.

  1. Project → Administration → Analysis Scope → Source File Exclusions

When the same pattern is configured only at the project level, files under the content directory are still analyzed and issues are reported.

We also checked the following:

  • We checked whether sonar.exclusions was being configured on the Azure side and temporarily removed it for testing.
  • We confirmed that the project-level sonar.exclusions value is visible in Show SonarScanner Context.
  • We confirmed that the exact same exclusion pattern works when configured under Global Source File Exclusions.
  • Therefore, we do not believe this is related to the wildcard pattern itself.
  • We also recreated the project and performed a new analysis, but the behavior remained unchanged.

One example of a file that should be excluded is:

code/Source/Web/Features/Custom.FrontEnd.Common/Content/less/3rdParty/elements.less

code/Source/Web/Features/Custom.FrontEnd.Common/Content/less/3rdParty/front.js

Project-level exclusion:

**/content/**

However, this file is still analyzed and issues are reported for it.

Questions:

  1. Is there any known issue with Project-level Source File Exclusions in SonarQube Community Build 26.1.0.118079?
  2. Is there any known reason why sonar.exclusions can be visible in Scanner Context but still not be applied during analysis?
  3. Is it expected behavior that Global Source File Exclusions work while Project-level Source File Exclusions do not?
  4. Can using SonarScanner for .NET affect this behavior?

Thank you.

2

Since the same pattern works globally, the pattern itself is fine. The usual reason project-level exclusions get ignored is the scanner passing sonar.exclusions explicitly from the pipeline or command line, which overrides whatever is set in the UI. You mentioned removing it on the Azure side for testing, so the other thing to confirm is that the analysis youre checking actually ran after the project setting was saved. Exclusions only apply to new analyses, never retroactively.

3

Thank you for the suggestions. We removed the sonar.exclusions value from the Azure DevOps side and started a completely new analysis, but the issue still persists. We even deleted and recreated the project and performed a new analysis, but the files were still not excluded. We also verified in the Show SonarScanner Context section that the project-level sonar.exclusions value is being passed to the scanner. However, Project-level Source File Exclusions are still not being applied.

During my investigation the following day, I noticed that although I had removed the sonar.exclusions value from the Azure DevOps pipeline, it was still displayed under Project scanner properties in the Show SonarScanner Context section. Therefore, I believe this was the reason why the files were not being excluded during the scans.

However, the project directories used for the analysis were deleted before each scan, and just to be safe, we had also manually cleaned up related files and folders such as .sonarqube.

In the latest scan I performed today, sonar.exclusions was no longer displayed under Show SonarScanner Context → Project scanner properties, and the file exclusions started working correctly.

Is it possible that these settings are being cached or stored somewhere outside the analysis directory?

In any case, the issue is currently resolved. Thank you for your help and suggestions.