Pull request - Quality gate new code not being scanned

SonarQube Server / Community Build
, ,
1

Hi,

We’re using:

  • SonarQube Developer Edition 8.9.7
  • Github
  • Google cloud platform
  • Maven
  • Java 1.8

Issue in short: when we update a pull request and create an issue, this issue is not reported by SonarQube on the pull request.

Scenario:

  • we create a branch from the master
  • we create a pull request from this branch to the master
  • we introduce, for test purpose, a high severity issue

The new code is not visible in the code tab

image
image3262×1784 211 KB

image
image3349×724 77.8 KB

The arguments passed
mvn sonar:sonar -P sonarscanner -Dsonar.analysis.buildNumber=$BUILD_ID -Dsonar.analysis.commitSha=$COMMIT_SHA -Dsonar.qualitygate.wait=true -Dsonar.pullrequest.branch=$BRANCH_NAME -Dsonar.pullrequest.base=master -Dsonar.pullrequest.key=$_PR_NUMBER -Dsonar.projectKey=com.snapengage:snapengage -Dsonar.organization=default-organization -Dsonar.language=java -Dsonar.binaries=build/classes -Dsonar.scm.revision=$(git rev-parse --abbrev-ref HEAD) -Dsonar.verbose=true -X;

In the logs, it shows “SCM reported 0 files changed in the branch” and the Merge base hash is pointing to the commit of the Pull request branch.

image
image3695×462 176 KB

I added Dsonar.scm.revision=$(git rev-parse --abbrev-ref HEAD) after checking a similar issue here but that hasn’t worked.

Please let us know what needs to be changed in order to get this working.

Best regards,
Akshay

2

Hi Akshay,

Welcome to the community!

Could you provide your full analysis log (text, not screenshot) starting from the analysis command?

 
Thx,
Ann

3

Hi Ann,

The logs contain sensitive information, I would prefer if I can share the full analysis log privately. Can you provide an email ID to which I can send the logs?

Akshay

4

Hi Akshay,

Feel free to redact the sensitive information.

 
Ann

5

Hi Ann,

Please find the full analysis log with debug enabled
Sonarqube_qualityGate.zip (777.3 KB)

Best regards,
Akshay

6

Hi Akshay,

The log is nearly 300k lines. Can you narrow it down for me with the name of the file where you introduced the missing issue?

 
Ann

7

Based on the logs in the original post, it looks like the scanner is not detecting any changed code with git.

Could you check if the merge base sha1 that is in the logs is correct? And that the diff between the sha1 being analyzed and the merge base sha1 is not empty?