we have been using the PR-Analysis feature of SonarQube for a couple of months now. We set up a SonarQube Quality Gate on the PR in order to protect the main branch. Despite this, we are occasionally observing Sonar issues popping up on the main branch. Those issues should have been found on the PR and “closed” the Quality Gate.
- versions used: SonarQube Developer Edition 7.9.1, Gradle Plugin id ‘org.sonarqube’ version ‘2.8’, Jdk 11, BitBucket 6.7.2
- error observed: Pull Request Analysis shows only issues located in changed lines of code, but not issues indirectly caused by the change
- steps to reproduce:
- On the develop-Branch (the master branch), create a Class with one private member variable and a setter-Mehtod.
- On a PR-Branch, remove the setter-Methode, commit, push
- The PR-Analysis does not report an issue for the unused variable (This is the problem!)
- After the merge of the PR to develop, this causes a Sonar-Issue (squid:S1068) because of the unused variable.
- potential workaround: do an incremental analysis in the IDE with SonarLint, or do a full analyis of the PR-Branch in the CI-Build.