Sonarcloud Configuration with aggregate pomfile and additional languages

SonarQube Cloud
1

I am currently trying to run sonarcloud scanning on a somewhat complicated project, which includes both multiple independent modules and multiple languages. I am able to use the maven SonarScanner to analyze the java components, or the GitHub Actions for Sonarcloud to scan the non-java components, but I have not yet been able to do both at once.

How should I configure this? Directory structure is equivalent to the following:
image

I have so far tried adding different settings for sonar.sources, or including the additional folders we want to scan as resources in the aggregate pomfile, but without luck.

Tech Stack:

  • Github Actions
  • JDK 11

Command Used:

  • mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=PROJECT_NAME
  • Have also tried adding -Dsonar.sources=relevantFolders or -Dsonar.sources=. to get it to pick up additional files, with the error reported below

Languages:

  • Languages of the repository are Java (primarily), javascript/typescript, python, terraform

Errors:

  • If using sonar.sources=. in command, error is javaModule/pom.xml can't be indexed twice. Please check that inclusion/exclusion patterns produce disjoint sets for main and test files
  • If using sonar.sources=mixedFiles/typescriptFiles,pythonFiles,terraform, error is The directory '/home/runner/work/REPO_NAME/REPO_NAME/javaModule/terraform' does not exist for Maven module ***:javaModule:jar:1.0. Please check the property sonar.sources -> [Help 1]
  • If not using sonar.sources property the scanner is able to run, but SonarCloud only scans Java components
2

Hey there.

Do all the subfolders (like pythonFiles) also have a pom.xml, meaning they’re properly part of the Maven project?

3

Hi Colin, only the folders containing Java files and the root directory contain pomfiles - should I add additional pomfiles to the other folders in order to get sonarcloud to pick them up?

The other thing I did already try was adding a copy-resources goal to the validate phase, to copy in the contents of the non-java folders, but that also didn’t work.

4

The Scanner for Maven is relying on the parent POM to reference all the modules that will be analyzed.

Because properties are inherited from the parent POM to children POM (or when setting -Dsonar.sources, it looks for directories in those modules that don’t exist, instead of looking for them outside the modules.

You should be able to take the strategy that this user did: