SonarCloud Coverage is 0%

  • ALM: Bitbucket Cloud
  • CI: Circle CI
  • Languages of the repository: Python

*Error Observed: My code coverage is saying 0%. I have added the below to my sonar properties file:
sonar.tests=tests/
sonar.sources=collect_files '-type d' src
sonar.python.coverage.reportPaths=test-results/junit.xml
sonar-python.xunit.reportPath=test-results.junit.xml

I see the tests have passed within CircleCi and an artifact has been created. My code coverage within SonarCloud is still 0%. I am using pytest to create a junit.xml file for my test results.

What do the logs say about importing code coverage?

INFO: 12/12 source files have been analyzed
INFO: The Python analyzer was able to leverage cached data from previous analyses for 0 out of 12 files. These files were not parsed.
INFO: Sensor Python Sensor [python] (done) | time=1407ms
INFO: Sensor Cobertura Sensor for Python coverage [python]
INFO: Python test coverage
INFO: Parsing report '/home/circleci/project/test-results/junit.xml'
INFO: Sensor Cobertura Sensor for Python coverage [python] (done) | time=126ms
INFO: Sensor PythonXUnitSensor [python]
INFO: Sensor PythonXUnitSensor [python] (done) | time=34ms
INFO: Sensor Python HTML templates processing [securitypythonfrontend]
INFO: Sensor Python HTML templates processing [securitypythonfrontend] (done) | time=21ms
INFO: Sensor JaCoCo XML Report Importer [jacoco]
INFO: 'sonar.coverage.jacoco.xmlReportPaths' is not defined. Using default locations: target/site/jacoco/jacoco.xml,target/site/jacoco-it/jacoco.xml,build/reports/jacoco/test/jacocoTestReport.xml
INFO: No report imported, no coverage information will be imported by JaCoCo XML Report Importer
INFO: Sensor JaCoCo XML Report Importer [jacoco] (done) | time=2ms
INFO: Sensor IaC Docker Sensor [iac]
INFO: 0 source files to be analyzed
INFO: 0/0 source files have been analyzed
INFO: Sensor IaC Docker Sensor [iac] (done) | time=73ms
INFO: Sensor Serverless configuration file sensor [security]
INFO: 0 Serverless function entries were found in the project
INFO: 0 Serverless function handlers were kept as entrypoints
INFO: Sensor Serverless configuration file sensor [security] (done) | time=3ms
INFO: Sensor AWS SAM template file sensor [security]
INFO: Sensor AWS SAM template file sensor [security] (done) | time=1ms
INFO: Sensor AWS SAM Inline template file sensor [security]
INFO: Sensor AWS SAM Inline template file sensor [security] (done) | time=1ms
INFO: Sensor javabugs [dbd]
INFO: Reading IR files from: /home/circleci/project/.scannerwork/ir/java
INFO: No IR files have been included for analysis.
INFO: Sensor javabugs [dbd] (done) | time=2ms
INFO: Sensor pythonbugs [dbd]
INFO: Reading IR files from: /home/circleci/project/.scannerwork/ir/python
INFO: Analyzing 7 functions to detect bugs.
INFO: Sensor pythonbugs [dbd] (done) | time=291ms
INFO: Sensor TextAndSecretsSensor [text]
INFO: Available processors: 8
INFO: Using 8 threads for analysis.
INFO: 12 source files to be analyzed
INFO: 12/12 source files have been analyzed
INFO: Sensor TextAndSecretsSensor [text] (done) | time=397ms
INFO: Sensor JavaSecuritySensor [security]
INFO: Enabled taint analysis rules: S2076, S2078, S2083, S2091, S2631, S3649, S5131, S5135, S5144, S5145, S5146, S5147, S5334, S5883, S6096, S6173, S6287, S6350, S6384, S6390, S6398, S6399, S6547, S6549
INFO: Load type hierarchy and UCFGs: Starting
INFO: Load type hierarchy: Starting
INFO: Reading type hierarchy from: /home/circleci/project/.scannerwork/ucfg2/java
INFO: Read 0 type definitions
INFO: Load type hierarchy: Time spent was 00:00:00.002
INFO: Load UCFGs: Starting
INFO: Load UCFGs: Time spent was 00:00:00.000
INFO: Load type hierarchy and UCFGs: Time spent was 00:00:00.002
INFO: No UCFGs have been included for analysis.
INFO: java security sensor: Time spent was 00:00:00.005
INFO: Sensor JavaSecuritySensor [security] (done) | time=15ms
INFO: Sensor CSharpSecuritySensor [security]
INFO: Enabled taint analysis rules: S2076, S2078, S2083, S2091, S2631, S3649, S5131, S5135, S5144, S5145, S5146, S5334, S5883, S6096, S6173, S6287, S6350, S6399, S6639, S6641
INFO: Load type hierarchy and UCFGs: Starting
INFO: Load type hierarchy: Starting
INFO: Reading type hierarchy from: /home/circleci/project/ucfg2/cs
INFO: Read 0 type definitions
INFO: Load type hierarchy: Time spent was 00:00:00.000
INFO: Load UCFGs: Starting
INFO: Load UCFGs: Time spent was 00:00:00.000
INFO: Load type hierarchy and UCFGs: Time spent was 00:00:00.000
INFO: No UCFGs have been included for analysis.
INFO: csharp security sensor: Time spent was 00:00:00.000
INFO: Sensor CSharpSecuritySensor [security] (done) | time=1ms
INFO: Sensor PhpSecuritySensor [security]
INFO: Enabled taint analysis rules: S2076, S2078, S2083, S2091, S2631, S3649, S5131, S5135, S5144, S5145, S5146, S5334, S5335, S5883, S6173, S6287, S6350
INFO: Load type hierarchy and UCFGs: Starting
INFO: Load type hierarchy: Starting
INFO: Reading type hierarchy from: /home/circleci/project/.scannerwork/ucfg2/php
INFO: Read 0 type definitions
INFO: Load type hierarchy: Time spent was 00:00:00.000
INFO: Load UCFGs: Starting
INFO: Load UCFGs: Time spent was 00:00:00.000
INFO: Load type hierarchy and UCFGs: Time spent was 00:00:00.000
INFO: No UCFGs have been included for analysis.
INFO: php security sensor: Time spent was 00:00:00.000
INFO: Sensor PhpSecuritySensor [security] (done) | time=1ms
INFO: Sensor PythonSecuritySensor [security]
INFO: Enabled taint analysis rules: S2076, S2078, S2083, S2091, S2631, S3649, S5131, S5135, S5144, S5145, S5146, S5147, S5334, S5496, S6287, S6350, S6639, S6680, S6776, S6839
INFO: Load type hierarchy and UCFGs: Starting
INFO: Load type hierarchy: Starting
INFO: Reading type hierarchy from: /home/circleci/project/.scannerwork/ucfg2/python
INFO: Read 296 type definitions
INFO: Load type hierarchy: Time spent was 00:00:00.075
INFO: Load UCFGs: Starting
INFO: Reading UCFGs from: /home/circleci/project/.scannerwork/ucfg2/python
INFO: Load UCFGs: Time spent was 00:00:00.274
INFO: Load type hierarchy and UCFGs: Time spent was 00:00:00.350
INFO: Analyzing 1273 UCFGs to detect vulnerabilities.
INFO: Check cache: Starting
INFO: Load cache: Starting
INFO: Load cache: Time spent was 00:00:00.000
INFO: Check cache: Time spent was 00:00:00.000
INFO: Create runtime call graph: Starting
INFO: Variable Type Analysis #1: Starting
INFO: Create runtime type propagation graph: Starting
INFO: Create runtime type propagation graph: Time spent was 00:00:00.017
INFO: Run SCC (Tarjan) on 2699 nodes: Starting
INFO: Run SCC (Tarjan) on 2699 nodes: Time spent was 00:00:00.007
INFO: Tarjan found 2699 strongly connected components
INFO: Propagate runtime types to strongly connected components: Starting
INFO: Propagate runtime types to strongly connected components: Time spent was 00:00:00.013
INFO: Variable Type Analysis #1: Time spent was 00:00:00.040
INFO: Variable Type Analysis #2: Starting
INFO: Create runtime type propagation graph: Starting
INFO: Create runtime type propagation graph: Time spent was 00:00:00.009
INFO: Run SCC (Tarjan) on 2681 nodes: Starting
INFO: Run SCC (Tarjan) on 2681 nodes: Time spent was 00:00:00.003
INFO: Tarjan found 2681 strongly connected components
INFO: Propagate runtime types to strongly connected components: Starting
INFO: Propagate runtime types to strongly connected components: Time spent was 00:00:00.008
INFO: Variable Type Analysis #2: Time spent was 00:00:00.022
INFO: Create runtime call graph: Time spent was 00:00:00.066
INFO: Load config: Starting
INFO: Load config: Time spent was 00:00:00.120
INFO: Compute entry points: Starting
INFO: Compute entry points: Time spent was 00:00:00.068
INFO: No entry points found.
INFO: python security sensor: Time spent was 00:00:00.608
INFO: python security sensor: Begin: 2024-04-18T14:19:30.467935360Z, End: 2024-04-18T14:19:31.076496642Z, Duration: 00:00:00.608
  Load type hierarchy and UCFGs: Begin: 2024-04-18T14:19:30.468100914Z, End: 2024-04-18T14:19:30.818392850Z, Duration: 00:00:00.350
    Load type hierarchy: Begin: 2024-04-18T14:19:30.468125021Z, End: 2024-04-18T14:19:30.543315051Z, Duration: 00:00:00.075
    Load UCFGs: Begin: 2024-04-18T14:19:30.543513801Z, End: 2024-04-18T14:19:30.818155024Z, Duration: 00:00:00.274
  Check cache: Begin: 2024-04-18T14:19:30.818543762Z, End: 2024-04-18T14:19:30.819052887Z, Duration: 00:00:00.000
    Load cache: Begin: 2024-04-18T14:19:30.818585685Z, End: 2024-04-18T14:19:30.818631111Z, Duration: 00:00:00.000
  Create runtime call graph: Begin: 2024-04-18T14:19:30.819158441Z, End: 2024-04-18T14:19:30.886106998Z, Duration: 00:00:00.066
    Variable Type Analysis #1: Begin: 2024-04-18T14:19:30.819828476Z, End: 2024-04-18T14:19:30.859855506Z, Duration: 00:00:00.040
      Create runtime type propagation graph: Begin: 2024-04-18T14:19:30.820667024Z, End: 2024-04-18T14:19:30.837871370Z, Duration: 00:00:00.017
      Run SCC (Tarjan) on 2699 nodes: Begin: 2024-04-18T14:19:30.838397224Z, End: 2024-04-18T14:19:30.845464648Z, Duration: 00:00:00.007
      Propagate runtime types to strongly connected components: Begin: 2024-04-18T14:19:30.845762020Z, End: 2024-04-18T14:19:30.859642511Z, Duration: 00:00:00.013
    Variable Type Analysis #2: Begin: 2024-04-18T14:19:30.861494129Z, End: 2024-04-18T14:19:30.884146207Z, Duration: 00:00:00.022
      Create runtime type propagation graph: Begin: 2024-04-18T14:19:30.861607685Z, End: 2024-04-18T14:19:30.871113177Z, Duration: 00:00:00.009
      Run SCC (Tarjan) on 2681 nodes: Begin: 2024-04-18T14:19:30.871364359Z, End: 2024-04-18T14:19:30.875156896Z, Duration: 00:00:00.003
      Propagate runtime types to strongly connected components: Begin: 2024-04-18T14:19:30.875407753Z, End: 2024-04-18T14:19:30.883933866Z, Duration: 00:00:00.008
  Load config: Begin: 2024-04-18T14:19:30.886269473Z, End: 2024-04-18T14:19:31.007040049Z, Duration: 00:00:00.120
  Compute entry points: Begin: 2024-04-18T14:19:31.007269984Z, End: 2024-04-18T14:19:31.076246514Z, Duration: 00:00:00.068
INFO: python security sensor peak memory: 122 MB
INFO: Sensor PythonSecuritySensor [security] (done) | time=611ms
INFO: Sensor JsSecuritySensor [security]
INFO: Enabled taint analysis rules: S5696, S5883, S6096, S6350, S3649, S2631, S5146, S5144, S5334, S6105, S6287, S2076, S5147, S2083, S5131
INFO: Load type hierarchy and UCFGs: Starting
INFO: Load type hierarchy: Starting
INFO: Reading type hierarchy from: /home/circleci/project/.scannerwork/ucfg2/js
INFO: Read 0 type definitions
INFO: Load type hierarchy: Time spent was 00:00:00.000
INFO: Load UCFGs: Starting
INFO: Load UCFGs: Time spent was 00:00:00.000
INFO: Load type hierarchy and UCFGs: Time spent was 00:00:00.000
INFO: No UCFGs have been included for analysis.
INFO: js security sensor: Time spent was 00:00:00.000
INFO: Sensor JsSecuritySensor [security] (done) | time=1ms
INFO: ------------- Run sensors on project
INFO: Sensor Zero Coverage Sensor
INFO: Sensor Zero Coverage Sensor (done) | time=6ms
INFO: SCM Publisher SCM provider for this project is: git
INFO: SCM Publisher 5 source files to be analyzed
INFO: SCM Publisher 5/5 source files have been analyzed (done) | time=151ms
INFO: CPD Executor 2 files had no CPD blocks
INFO: CPD Executor Calculating CPD for 4 files
INFO: CPD Executor CPD calculation finished (done) | time=5ms
INFO: Analysis report generated in 101ms, dir size=260 KB
INFO: Analysis report compressed in 29ms, zip size=65 KB
INFO: Analysis report uploaded in 361ms
INFO: ANALYSIS SUCCESSFUL, you can find the results at: <sonarcloud link>
INFO: Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
INFO: More about the report processing at <sonarcloud link>
INFO: Sensor cache published successfully
INFO: Analysis total time: 16.387 s
INFO: ------------------------------------------------------------------------
INFO: EXECUTION SUCCESS
INFO: ------------------------------------------------------------------------
INFO: Total time: 19.288s
INFO: Final Memory: 24M/94M
INFO: ------------------------------------------------------------------------

Thanks.

Is this really a Cobertura coverage report? The file path would make me think differently… You can find documentation on generating a coverage report here.