We’ve discovered that our new code no longer fails the quality gate. This used to work perfectly, but stopped a few months ago.
I created a new, short-lived branch and introduced overly complex code so that SonarCloud would raise new issues. We use Sonar’s built-in quality gate, which allows no new issues (A = 0 or more info issues). My new code raises one medium and one high maintainability issue.
While the branch summary page correctly displays the number of new lines and issues, the quality gate shows ‘passed’.
On the ‘Overview’ page, under ‘Latest activity’, the same branch shows zero issues and zero new lines. Perhaps this is because I started the analysis several times?
What I have tried so far:
Set new code from “previous version” to “number of days”
Update scanner image
Setting “Ignore duplication and coverage on small changes” to false
When we introduced SonarQube at the beginning of this year, this worked perfectly, but a few months ago it stopped working. Could there have been some changes in the SonarCloud version that have led to this behaviour?
Here is what we use:
CI: Jenkins
Languages of the repository: Multiple (Monorepo: TS, Java, phoenix, …)
Due to the size of our repository, we use a shallow clone. Perhaps this is the root cause of the problem. However, as I mentioned, it worked previously and we did not change the Git checkout.
Quality gate status can’t actually be computed on first analysis since there is no “new” code yet. Depending on your quality gate conditions, it’ll likely fail on the next analysis.
We try to keep it to one topic per thread. Otherwise it can get messy, fast. I’m not going to ask you to open another thread for this though. I’ll just let you know that this should clear soon. We had an incident earlier today that backed up some queues.
I was just trying to give you more hints to solve the issues. The new lines of code are now shown in the file and was probably related to the incident you had.
At a guess, you’re creating a new branch with each analysis. Can you share your analysis configuration, as well as your analysis log?
The analysis / scanner log is what’s output from the analysis command. Hopefully, the log you provide - redacted as necessary - will include that command as well.
Here is our sonar.properties file and the analysis log. I had to redact file and directory names. To make this easier for me I replaced similar debug lines with “…”.
(I renamed sonar-project to txt in order to upload it here)
One odd thing I’ve noticed is that when I introduce code duplication, the quality gate fails. The same thing happens if I switch to the built-in SonarWay quality gate (with code coverage). Only issues are ignored by the quality gate.
To refresh myself on your context before I dove into your logs, I took another look at your previous set of screenshots. I need to point out that the “New Analysis” flag is different from the “First Analysis” flag.
I’ve raised the point internally that if every analysis gets a “New Analysis” flag (which it does, after the first one) then there’s no real point in having the flag at all. But that’s a discussion for a different day.
So, leaving that flag aside, your failed quality gate shows the mechanism is working. Now I need to ask what’s in your quality gate. Can you share a screenshot of the conditions that are applied?
Yes, unfortunately the maintainability rating is calculated differently than the other ratings. You’re not the first to stumble on this. If you want your Quality Gate to fail for any and all new issues then the criterion you need to set is New Issues > 0.
