# Sonar Analysis Completely Fails

**URL:** <https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118>\
**Category:** SonarQube Cloud\
**Tags:** scanner\
**Created:** [June 20, 2022, 7:34pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118 "2022-06-20T19:34:07Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roger\_Bukuru](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/roger_bukuru/32/28484_2.png) [@Roger\_Bukuru](https://community.sonarsource.com/u/Roger_Bukuru)\
**Post date:** [June 20, 2022, 7:34pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/1 "2022-06-20T19:34:07Z")

</div>

I am using the sonar cli tool to try to run analysis but the analyses simply fails we keep getting the following error:

```auto
tonderai-bhpartners-generic-pipeline_1 | 21:20:58.402 ERROR: Error during SonarScanner execution
tonderai-bhpartners-generic-pipeline_1 | java.lang.NullPointerException
tonderai-bhpartners-generic-pipeline_1 | at org.eclipse.jgit.internal.storage.file.UnpackedObjectCache$Table.index(UnpackedObjectCache.java:115)
tonderai-bhpartners-generic-pipeline_1 | at org.eclipse.jgit.internal.storage.file.UnpackedObjectCache$Table.contains(UnpackedObjectCache.java:76)
tonderai-bhpartners-generic-pipeline_1 | at org.eclipse.jgit.internal.storage.file.UnpackedObjectCache.isUnpacked(UnpackedObjectCache.java:31)
tonderai-bhpartners-generic-pipeline_1 | at org.eclipse.jgit.internal.storage.file.LooseObjects.hasCached(LooseObjects.java:82)
tonderai-bhpartners-generic-pipeline_1 | at org.eclipse.jgit.internal.storage.file.ObjectDirectory.openObjectWithoutRestoring(ObjectDirectory.java:339)
tonderai-bhpartners-generic-pipeline_1 | at org.eclipse.jgit.internal.storage.file.ObjectDirectory.openObject(ObjectDirectory.java:330)
tonderai-bhpartners-generic-pipeline_1 | at org.eclipse.jgit.internal.storage.file.WindowCursor.open(WindowCursor.java:132)
tonderai-bhpartners-generic-pipeline_1 | at org.eclipse.jgit.lib.ObjectReader.open(ObjectReader.java:212)
tonderai-bhpartners-generic-pipeline_1 | at org.eclipse.jgit.revwalk.RevWalk.parseAny(RevWalk.java:917)
tonderai-bhpartners-generic-pipeline_1 | at org.eclipse.jgit.revwalk.RevWalk.parseCommit(RevWalk.java:827)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.scm.git.CompositeBlameCommand.collectAllCommittedFiles(CompositeBlameCommand.java:94)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.scm.git.CompositeBlameCommand.blame(CompositeBlameCommand.java:61)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.scanner.scm.ScmPublisher.publish(ScmPublisher.java:76)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.scanner.scan.ProjectScanContainer.doAfterStart(ProjectScanContainer.java:405)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:123)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:109)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.scanner.bootstrap.GlobalContainer.doAfterStart(GlobalContainer.java:128)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:123)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:109)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.batch.bootstrapper.Batch.doExecute(Batch.java:58)
tonderai-bhpartners-generic-pipeline_1 | at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:52)
tonderai-bhpartners-generic-pipeline_1 | at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)
tonderai-bhpartners-generic-pipeline_1 | at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
tonderai-bhpartners-generic-pipeline_1 | at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
tonderai-bhpartners-generic-pipeline_1 | at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
tonderai-bhpartners-generic-pipeline_1 | at java.base/java.lang.reflect.Method.invoke(Unknown Source)
tonderai-bhpartners-generic-pipeline_1 | at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)
tonderai-bhpartners-generic-pipeline_1 | at com.sun.proxy.$Proxy0.execute(Unknown Source)
tonderai-bhpartners-generic-pipeline_1 | at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)
tonderai-bhpartners-generic-pipeline_1 | at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)
tonderai-bhpartners-generic-pipeline_1 | at org.sonarsource.scanner.cli.Main.execute(Main.java:112)
tonderai-bhpartners-generic-pipeline_1 | at org.sonarsource.scanner.cli.Main.execute(Main.java:75)
tonderai-bhpartners-generic-pipeline_1 | at org.sonarsource.scanner.cli.Main.main(Main.java:61)

```

Our confiugration file is as follow

```auto
# Project identification
sonar.exclusions= **/build/** , **/coverage/** , **/logs/** , **/chart/** , **/*.go,** /spinnaker/ **,** /stages/**
sonar.projectKey=xxxxx
sonar.projectVersion="v0.0.1"
sonar.projectName=xxxxx
sonar.organization=xxxx
sonar.host.url=https://sonarcloud.io
# Info required for Sonar
sonar.sources=.
sonar.coverage.jacoco.xmlReportPaths=**/jacoco/test/jacocoTestReport.xml
sonar.coverage.exclusions= **/test/**
sonar.cpd.exclusions= **/test/**

```

We are simply trying to run the command `sonar-scanner` but it fails. Not sure what’s wrong. Any assistance will be really helpful as we have been experiencing this for some time now. We are make use of the latest version of the cli tool.

---

<div class="post-metadata">

**Author:** ![Alexandre\_Holzhey](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_holzhey/32/74760_2.png) [@Alexandre\_Holzhey](https://community.sonarsource.com/u/Alexandre_Holzhey)\
**Post date:** [June 21, 2022, 12:25pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/3 "2022-06-21T12:25:59Z")

</div>

Hi @Roger_Bukuru and welcome to our Community!

I would like to ask you to:

1. Add the “-X” parameter to the scanner invocation in order to enable debug output.
2. Provide us with the full scanner log output.

I will send you a private message for you to do that. This way we can have much more information that we need to understand your problem.

Thanks.

---

<div class="post-metadata">

**Author:** ![simonedimaria](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/simonedimaria/32/34430_2.png) [@simonedimaria](https://community.sonarsource.com/u/simonedimaria)\
**Post date:** [June 21, 2022, 2:05pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/5 "2022-06-21T14:05:07Z")

</div>

Facing the same issue:

```auto
$ sonar-scanner -X \ 
  -Dsonar.projectKey=Demo1 \
  -Dsonar.sources=. \
  -Dsonar.host.url=http://localhost:9000 \
 -Dsonar.login=sqp.xxxxxxxxxxxxxxxxxxxxxxxxxx

```

output:  
[output.txt](https://community.sonarsource.com/uploads/short-url/t4hUZTqIci9fprQmio6wZSO6GE5.txt) (41.2 KB)

---

<div class="post-metadata">

**Author:** ![dmeneses](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/dmeneses/32/2933_2.png) [@dmeneses](https://community.sonarsource.com/u/dmeneses)\
**Post date:** [June 21, 2022, 7:42pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/6 "2022-06-21T19:42:15Z")

</div>

Hi, are the failing projects in a valid git repository? Does the file `{project_dir}/.git/HEAD` exist?

---

<div class="post-metadata">

**Author:** ![simonedimaria](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/simonedimaria/32/34430_2.png) [@simonedimaria](https://community.sonarsource.com/u/simonedimaria)\
**Post date:** [June 21, 2022, 9:29pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/7 "2022-06-21T21:29:55Z")

</div>

Oh okay, it has to be a valid git repo. Now it’s working, didn’t think about it cause I was testing a single .php file. However, the results don’t show any vulnerabilities, although there are clear SQL injections in my .php file. any advice?

---

<div class="post-metadata">

**Author:** ![Roger\_Bukuru](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/roger_bukuru/32/28484_2.png) [@Roger\_Bukuru](https://community.sonarsource.com/u/Roger_Bukuru)\
**Post date:** [June 22, 2022, 12:10am UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/8 "2022-06-22T00:10:15Z")

</div>

Hi,

Yes it’s in a valid git repo ☹

---

<div class="post-metadata">

**Author:** ![Alexandre\_Holzhey](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_holzhey/32/74760_2.png) [@Alexandre\_Holzhey](https://community.sonarsource.com/u/Alexandre_Holzhey)\
**Post date:** [June 22, 2022, 6:19am UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/9 "2022-06-22T06:19:09Z")

</div>

> [@simonedimaria](#):
>
> Oh okay, it has to be a valid git repo

You can try adding the following parameter to disable SCM features, but it will disable related features as well, like auto assignment of new issues:

```auto
sonar.scm.disabled=true

```

> [@simonedimaria](#):
>
> However, the results don’t show any vulnerabilities, although there are clear SQL injections in my .php file. any advice?

This is a different subject and you should create a new topic for that, providing all the information. Thanks!

---

<div class="post-metadata">

**Author:** ![Alexandre\_Holzhey](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_holzhey/32/74760_2.png) [@Alexandre\_Holzhey](https://community.sonarsource.com/u/Alexandre_Holzhey)\
**Post date:** [June 22, 2022, 6:22am UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/10 "2022-06-22T06:22:36Z")

</div>

> [@Roger\_Bukuru](#):
>
> Yes it’s in a valid git repo

We are still investigating! 😉 Could you tell me anything related to the status of the GIT repository that you are scanning with SonarCloud? Like, for example:

1. Do you have any non-committed files (staged or not)?
2. Any detached head scenario?
3. The branch exists at origin?
4. There is at least one commit at your repository?

---

<div class="post-metadata">

**Author:** ![Roger\_Bukuru](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/roger_bukuru/32/28484_2.png) [@Roger\_Bukuru](https://community.sonarsource.com/u/Roger_Bukuru)\
**Post date:** [June 22, 2022, 12:13pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/12 "2022-06-22T12:13:46Z")

</div>

1. No there are no non-committed files
2. I have checked and have seen none
3. Yes
4. Yes

We are having this issues across 3-5 different projects, that all have valid git repos.

---

<div class="post-metadata">

**Author:** ![Alexandre\_Holzhey](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_holzhey/32/74760_2.png) [@Alexandre\_Holzhey](https://community.sonarsource.com/u/Alexandre_Holzhey)\
**Post date:** [June 22, 2022, 12:27pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/13 "2022-06-22T12:27:31Z")

</div>

Thanks for the information.

> [@Roger\_Bukuru](#):
>
> We are having this issues across 3-5 different projects, that all have valid git repos.

Any public project so we can try to reproduce here?

---

<div class="post-metadata">

**Author:** ![Roger\_Bukuru](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/roger_bukuru/32/28484_2.png) [@Roger\_Bukuru](https://community.sonarsource.com/u/Roger_Bukuru)\
**Post date:** [June 22, 2022, 12:39pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/14 "2022-06-22T12:39:33Z")

</div>

Unfortunately they are all private, any other way ?

---

<div class="post-metadata">

**Author:** ![Alexandre\_Holzhey](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_holzhey/32/74760_2.png) [@Alexandre\_Holzhey](https://community.sonarsource.com/u/Alexandre_Holzhey)\
**Post date:** [June 22, 2022, 12:55pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/15 "2022-06-22T12:55:53Z")

</div>

I sent a private message to you in order to acquire more data to investigate this problem. So far, i found that we fail when there is no HEAD commit, which should happen only in a git repository without any commit. Maybe there are other scenarios that i don’t know.

---

<div class="post-metadata">

**Author:** ![Alexandre\_Holzhey](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_holzhey/32/74760_2.png) [@Alexandre\_Holzhey](https://community.sonarsource.com/u/Alexandre_Holzhey)\
**Post date:** [June 22, 2022, 3:00pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/16 "2022-06-22T15:00:04Z")

</div>

We are still investigating this issue, but we just deployed a fix that could mitigate your problem as well. Could you please try to run a new analysis and check if it succeeds? Also, please send use the scanner logs if possible, you can use the private message for this.

---

<div class="post-metadata">

**Author:** ![Roger\_Bukuru](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/roger_bukuru/32/28484_2.png) [@Roger\_Bukuru](https://community.sonarsource.com/u/Roger_Bukuru)\
**Post date:** [June 22, 2022, 4:20pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/17 "2022-06-22T16:20:31Z")

</div>

Ok great, is this a fix on the cli-scanner on just on sonar-cloud ?

---

<div class="post-metadata">

**Author:** ![Roger\_Bukuru](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/roger_bukuru/32/28484_2.png) [@Roger\_Bukuru](https://community.sonarsource.com/u/Roger_Bukuru)\
**Post date:** [June 22, 2022, 4:32pm UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/18 "2022-06-22T16:32:24Z")

</div>

I just gave it a try and it works! Thank you so much 🥹🕺🏿

---

<div class="post-metadata">

**Author:** ![Alexandre\_Holzhey](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_holzhey/32/74760_2.png) [@Alexandre\_Holzhey](https://community.sonarsource.com/u/Alexandre_Holzhey)\
**Post date:** [June 23, 2022, 6:21am UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/19 "2022-06-23T06:21:29Z")

</div>

> [@Roger\_Bukuru](#):
>
> Ok great, is this a fix on the cli-scanner on just on sonar-cloud ?

It is for SonarCloud, including the scanner as well.

> [@Roger\_Bukuru](#):
>
> I just gave it a try and it works! Thank you so much

Happy to know!! But i still want to investigate a bit more… is it possible for you to provide us with the scanner log for this successful analysis? 🙂

---

<div class="post-metadata">

**Author:** ![Alexandre\_Holzhey](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_holzhey/32/74760_2.png) [@Alexandre\_Holzhey](https://community.sonarsource.com/u/Alexandre_Holzhey)\
**Post date:** [June 28, 2022, 10:06am UTC](https://community.sonarsource.com/t/sonar-analysis-completely-fails/65118/20 "2022-06-28T10:06:42Z")

</div>

Hello @Roger_Bukuru , your analysis now succeeds but you are missing blame information (extract from the logs you send to me):

```auto
WARN: Could not find HEAD commit
INFO: Blaming files using native implementation
INFO: SCM Publisher 0/1043 source files have been analyzed (done) | time=55ms
WARN: Missing blame information for the following files:

```

This means that the cloned git repository at your pipeline is missing HEAD commit. We recommend to try diagnose this, getting more information about the state of the cloned git repository at your pipeline, maybe you can add some commands like:

```auto
git log -n 2
git status

```

Let me know if you want do dig more into this issue, happy to help.