Sonar Scan with compilation database file question

SonarQube Server / Community Build
,
1

HI,
I have a question on files scan.
we are running the SonarQube scanner and sending the compilation database file as parameter: -D"sonar.cfamily.variants.dir=compile_commands.json"
The scan result includes the entire files in our folders and not just the files that defined in the compilation database.
How can we set that only the compiled files will be part of our scan report?

It is C analysis
using build-wrapper
SonarQube Version 10.2.1

Best Regards,
Galit Oshri

2

Hi Galit,

I’m confused

First, you should use either the build wrapper or a compilation database. Second, that parameter is for analyzing multiple, different variants of your code, not for passing the compilation database.

Can you provide your full analysis command and configuration, please?

 
Thx,
Ann

3

Hi Ann,
Regarding to D"sonar.cfamily.variants.dir=compile_commands.json" - this is what describes here:

sonar.projectKey=myFirstProject

Our target is to scan only code files that are part of the compilation and relevant to our main build.

Best Regards,
Galit

4

Hi Galit,

Thanks for pointing me to the docs. :smiley:

They’re pretty clear that the expected value of sonar.cfamily.variants.dir is a directory. How many variations are you trying to analyze? If it’s only one, there’s no need to use the variants stuff.

 
Ann

5

Hi Ann,
Can you help with how can we configure the SonarQube to scan only the compiled files?
Is there other way to set only compiled files?
Thanks,
Galit

7

Hi Galit,

Per the docs

Any file that doesn’t end up in a compiled translation unit will not be analyzed. As a consequence, source files that are not compiled and header files that are not included in any compiled source file will not be analyzed.

So I’m not sure what’s going on here. I’ve flagged this for more expert eyes.

 
Ann

10

Hi @galit,

The C analyzer only analyze the code that is compiled according the the compilation database.

The scan result includes the entire files in our folders and not just the files that defined in the compilation database.

At the same time, yes by default, the scanner will index all the extension and show them in the SQ. This doesn’t mean that the C analyzer run of them. This is useful, you might have an issue in a compiled file with multiple locations spanning across uncompiled files. So having those files there, even though not analyzed is intentional.

In short,
SonarQube display indexed files which are based solely on file extensions.
The C analysis runs only on compiled files that are indexed.
If you want to change the filed displayed in SQ, the only way is to change the indexed file using sonar.exclusions Narrowing the focus with an analysis scope

Thanks,