Scan failing only on run triggered by Merging a PR

[cosmin.apopei (Cosmin)]

Details:

• ALM used: Azure DevOps
• CI system used: Azure DevOps
• Languages of the repository: C#
• Error observed:
  
  

Hello,
We have had some issues with Sonarcloud in one of our repos. The scan identifies a critical bug when running the pipeline after a Pull Request merge, but it does not when running the scan against the Pull Request branch; also worth noting that the bug identified by the scan is not in a file changed by the Pull Request.
The bug itself is also a bit strange: a csharpsquid:S2259 error is triggering on a line that has null coalescing setup and on a value that it is assumed not to be null in code before that line.
We are unsure why the scan is only failing on the run triggered by the merge and why it is picking up that line as a bug.

Please let me know if you need any other details,
Cosmin

[Colin]

Hey there.

This might just be some weird timing with deployment of some fixes to null detection on C# at the end of last week.

Improved Null Issue detection in C# and VB.NET

Hi .NET Folks We’re happy to announce some big improvements to our rules that detect issues with null values.You should see better detection, especially when using the latest C# versions with the following rules: Empty nullable value should not be accessed (also now in VB.NET) Arguments of public methods should be validated against null (also now in VB.NET) Null pointers should not be dereferenced Additionally, with the help of the ever generous @Corniel, we have a new regex rule: Regula…

And, if you believe the issue doesn’t make sense, I recommend adding full details following the guidelines in this post:

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

Out of curiosity, on the main branch, does this issue pollute the New Code period (or is it on very old code and sits only in the Overall Code?)