Sonar Scanning Whole Project on Merge / Pull Request

SonarQube Cloud
1

Hi

Please why is Sonar scanning the whole project in merge request?

2

This is URGENT please

3

Hi,

We’ll need a lot more context to help you. Can you provide your analysis log?

The analysis / scanner log is what’s output from the analysis command. Hopefully, the log you provide - redacted as necessary - will include that command as well.

This guide will help you find them.

 
Ann

4

Welcome back @ganncamp

Hope you enjoyed your time out.

To explain the situation in simple terms:
What happens is that sonarcloud scans a lot more code than was edit in a Merge / Pull Request.

5

Hi,

Thanks! It was lovely. :smiling_face:

This is more than likely about your SCM data, or rather a lack thereof.

Again, can we have your analysis log?

 
Ann

6

HI @ganncamp

Do you mean the logs from gitlab?

7

Hi,

So yes, if GitLab is your CI, then those are the logs I’m looking for.

 
Thx,
Ann

8

HI @ganncamp

Top of the day to you and it’s been awhile

Kindly find attached the logs as requested

job.txt (489.4 KB)

Below is also a screenshot from the project on sonar showing 36k new lines of code

Screenshot from 2024-06-19 11-22-23
Screenshot from 2024-06-19 11-22-231612×900 93.6 KB

Thx
Seun

9

Hi Seun,

Thanks for the log. Here’s the important part

07:05:41.790 INFO: SCM collecting changed files in the branch
07:05:41.794 WARN: Could not find ref: main-ecg in refs/heads, refs/remotes/upstream or refs/remotes/origin
07:05:41.794 DEBUG: All found refs are:
07:05:41.799 DEBUG: Ref[HEAD=d69494cc0677464193880701c7217bd5b005f548(-1)]
07:05:41.799 DEBUG: Ref[refs/pipelines/1322456773=d69494cc0677464193880701c7217bd5b005f548(-1)]
07:05:41.800 INFO: SCM collecting changed files in the branch (done) | time=10ms
07:05:41.800 DEBUG: SCM information about changed files in the branch is not available

And then again at the end:

07:06:03.290 INFO: SCM writing changed lines
07:06:03.293 WARN: Could not find ref: main-ecg in refs/heads, refs/remotes/upstream or refs/remotes/origin
07:06:03.293 DEBUG: All found refs are:
07:06:03.293 DEBUG: Ref[HEAD=d69494cc0677464193880701c7217bd5b005f548(-1)]
07:06:03.293 DEBUG: Ref[refs/pipelines/1322456773=d69494cc0677464193880701c7217bd5b005f548(-1)]
07:06:03.294 DEBUG: SCM reported changed lines for 0 files in the branch

Analysis needs the ref to understand what’s changed in the PR.

 
HTH,
Ann

10

Many thanks, Ann for your response.

Please see below my gitlab ci portion for the scan

Screenshot from 2024-06-19 16-00-06
Screenshot from 2024-06-19 16-00-061051×459 55.1 KB

Not sure what I am missing

11

Hi,

This isn’t about analysis; it’s about your checkout. Per the docs I linked:

Before analyzing your pull requests, make sure that:

  • The pull request source branch is checked out in the local repository.
  • The branch being targeted by the pull request is fetched and present in the local repository.

 
HTH,
Ann

12

Hi @ganncamp ,

Can we have a call to discuss and demo this?

I can have my dev team join as well

Kindly revert

Many thanks

13

Reminder

14

Hi,

We don’t do calls.

Please do some independent research on how to make this happen:

 
Thx,
Ann

15

HI @ganncamp

Please how can i reach the sonarcloud support team directly. …

I had been on a call with them recently

16

Hi,

If you have access to commercial support, then you should create a ticket with them.

Othewise, this is it.

 
Ann

17

Hi again,

I overlooked this line in your logs earlier:

07:06:03.076 WARN: Shallow clone detected, no blame information will be provided. You can convert to non-shallow with 'git fetch --unshallow'.

You can ‘unshallow’ your checkout with GIT_DEPTH: "0".

 
HTH,
Ann

18

Please how do you mean commercial support

The account is a paid account on sonarcloud.io

Kindly advise