Sonar Scan for .Net Project on GitHub Actions

SonarQube Cloud
1

Hi

Please i really need help on this

Going through the below link

I see that

image

This is confirmed by the below as sonar does not detect .Net in the scan

image
image1046×79 4.69 KB

Below also is my current github action script

on:
  # Trigger analysis when pushing in master or pull requests, and when creating
  # a pull request.
  push:
    branches:
      - master
      - staging
  pull_request:
      types: [opened, synchronize, reopened]
name: SonarCloud
jobs:
  sonarcloud:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:          
        args: >
          -Dsonar.projectKey=xxxxx_xxxxx
          -Dsonar.organization=xxxxx
          -Dsonar.c.file.suffixes=- -Dsonar.cpp.file.suffixes=- -Dsonar.objc.file.suffixes=-
          -Dsonar.exclusions="**/Migrations/*,**/*.c,**/*.cc,**/*.cpp,**/*.h"
        # Disabling shallow clone is recommended for improving relevancy of reporting
        # /Migrations/
        fetch-depth: 0    
    - name: SonarCloud Scan
      uses: sonarsource/sonarcloud-github-action@master
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
2

Hey there.

When you create a new project in SoanrCloud, there’s a tutorial right in the UI.

image
image1411×931 73.5 KB

You can also find it in your project’s Administration > Analysis Method

3

Hi @Colin ,

I was just praising you for your help so far in my work with sonar to @Silpa .

So i am currently trying this now and i will give a feedback afterwards

Cheer

1 Like
4

Hi @Colin

Kindly see below

Time Elapsed 00:08:41.28
SonarScanner for MSBuild 6.2
Using the .NET Core version of the Scanner for MSBuild
Post-processing started.
09:15:52.503  sonar-project.properties files are not understood by the SonarScanner for MSBuild. Remove those files from the following folders: D:\a\adora\adora
09:15:52.504  Post-processing failed. Exit code: 1
Error: Process completed with exit code 1.

Mind you I already have a sonar-project.properties

with the below content

sonar.organization=organization_name_in_sonarcloud
sonar.projectKey=project_key_in_sonarcloud

sonar.sources=.

Please help

5

The error message is pretty clear about what actions to take.

You should instead provide these values as command line arguments to the Scanner. See the docs here.

6

So they also stated in the yml file for the githb action

run: |
          .\.sonar\scanner\dotnet-sonarscanner begin /k:"xxxxx" /o:"xxxxx" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io"
          dotnet build
          .\.sonar\scanner\dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"

should i remove them from the sonar-project.properties file? or remove the file altogether?

7

Remove the file altogether.

8

Done and everything seem to be fine

Just that GitHub actions is scanning all the source code with every push

I need to be able to scan only the new changes to the source code

Please how do I achieve that?

9

Incremental Analysis is supported in the context of analyzing Pull Requests, but not branch analyses.

10

Hi @Colin
in light of the below

What else do I need to do to ens the scan of the pull request does not result in scanning the whole project again?

11

Specifically, in the context of a PR analysis, it should work out of the box when you follow the tutorial in the UI! If it’s not, I’d be happy to look at the logs of your job.

12

Hi @Colin

Many thanks yes i’ve been able to set this up and all that buh there is still a challenge

GH PR still does not stop the merge even when the QG fails

See below

image
image929×855 78.1 KB

sonarcloud

image
image1082×84 4.62 KB

and here’s the settings on GH

image
image813×365 29.1 KB

Please what am I missing

13

Is your project bound?

14

No it’s not, i use the steps in Analysis Method

image
image1322×690 53.8 KB

15

As I told you in this thread, you need a GitHub-bound organization

16

Hi @Colin

Does it mean I can not use the Quality Gates to block merges of new code that fails the quality gates?

17

If you have a Github-bound organization, sure you can. If not, then no, you cannot decorate the PR with a comment/status check, ultimately used to block the merge.

18

:slightly_frowning_face:

This is sad. … is there no other way. …

However, for one of my projects, not a .Net project the quality gate works and stops the merge of code that fails.

Please, there should be another way to get these .Net projects to work. …

19

Why can’t you create a bound GitHub organization?

Maybe you can share a screenshot or whatever is indicating to you that this is working for the non-NET project. Is the non-.NET project on GitHub or Azure DevOps?

20

All projects are on GitLab and GitHub

image
image880×361 37.2 KB

image
image756×702 83.1 KB

image
image1122×522 45.8 KB