[SCA, C++, vcpkg] Results may be missing due to analysis errors

SonarQube Cloud
, ,
1

  • ALM used Azure DevOps Servie

  • CI system used Azure DevOps self-hosted agent

  • Scanner command used when applicable (private details masked)

  • Languages of the repository: C++23, C#

  • Error observed (wrap logs/code around with triple quotes ``` for proper formatting)

    In SonarCloud only NoGet dependenies are shown, no dependencies from vcpkg. Instead, a warning: Results may be missing due to analysis errors regarding source/vcpkg.json

    ‘gtest *’ (vcpkg) was not resolved to an exact version.
    ‘mp-units *’ (vcpkg) was not resolved to an exact version.
    ‘pugixml *’ (vcpkg) was not resolved to an exact version.
    ‘boost-asio *’ (vcpkg) was not resolved to an exact version.
    ‘boost-uuid *’ (vcpkg) was not resolved to an exact version.
    ‘cpp-httplib *’ (vcpkg) was not resolved to an exact version.
    ‘nlohmann-json *’ (vcpkg) was not resolved to an exact version.

  • Steps to reproduce

    {
  "name": "solutionName",
  "version-semver": "0.0.1",
  "dependencies": [
    "gtest",
    "mp-units",
    "pugixml",
    "boost-asio",
    "boost-uuid",
    "cpp-httplib",
    "nlohmann-json"
  ]
}

          - task: SonarCloudPrepare@4
        inputs:
          SonarCloud: $(SonarQubeServiceConnection)
          organization: $(SonarQubeOrganization)
          extraProperties: |
            sonar.cfamily.reportingCppStandardOverride=c++23
            sonar.cfamily.enableModules=true
            sonar.cfamily.compile-commands=$(SonarOutDir)/compile_commands.json
            sonar.sca.cfamily=true
            sonar.sca.exclusions="scripts/test-*/**","source/*.Tests/**"
            sonar.sca.resolveAsRoot=true
            sonar.sca.resolveDependencies=true
            sonar.sca.resolveDependencySources=false

      - task: PowerShell@2
        inputs:
          pwsh: true
          targetType: inline
          workingDirectory: '$(SelfRepoRoot)'
          script: |
            & $vcpkgPath install --triplet x64-windows-v143 `
              --overlay-triplets ".\triplets" `
              --x-manifest-root ".\" `
              --x-install-root ".\vcpkg_installed\x64-windows-v143"

            & $msbuild WT.NXG.sln /t:restore
            & "$(BuildWrapper)" --out-dir "$(SonarOutDir)" `
              "$msbuild" MySolution.sln `
              /t:Rebuild /m:4 /p:Configuration=$(BuildConfiguration) /nodeReuse:False 

        - task: SonarCloudAnalyze@4

  • In Dec 2025, the vcpkg dependencies had already been displayed, see old thread.

    Regarding vcpkg.json in manifest mode only additional dependencies were added.
    Installation on the pipeline was at that time a target in a vcxproj file, which blocked rebuilds on developer workstations.

2

Hey @milbrandt, thanks for reporting this, and for sharing the detailed configuration. This looks related to a known limitation in vcpkg dependency resolution when a custom install root is used (in your case, --x-install-root ".\vcpkg_installed\x64-windows-v143"). We have a ticket in our backlog to address this, and I think it will fix your issue, but I will anyway flag this for the team so that they can have a look and confirm that it’s covered by our ticket.