Yes, sorry i should have mentioned that OP and me work in the same company.
Here is the full (as full as it can be) output of what we do and what we see as a result.
2 Screenshots are attached from BitBucket and SonarCloud UI respectfully as well.
#this is our sonar-project.properties file
# Organization and project keys are displayed in the right sidebar of the project homepage
sonar.organization=xxxx
sonar.projectKey=xxxx
sonar.host.url=https://sonarcloud.io
sonar.sources=xxxx
sonar.tests=./tests
sonar.language=php
sonar.sourceEncoding=UTF-8
sonar.php.coverage.reportPaths=/var/tmp/coverage_report.xml
sonar.php.tests.reportPath=/var/tmp/tests_report.xml
sonar.coverage.exclusions=xxxx
sonar.exclusions=xxxx
#end of our sonar-project.properties file
# clone repo
git clone xxGITURLxx && git fetch && git checkout hotfix/RGD-0000-BLABLA
.....
# do whatever changes youre doing, in this test case add a test commit with a dummy f()
git diff origin/development..HEAD
diff --git a/common/xxpath1xx/xxpath2xx/xxpath3xx/xxfile.class.phpxx b/common/xxpath1xx/xxpath2xx/xxpath3xx/xxfile.class.phpxx
index 6399982ac0f..044fc3bd051 100644
--- a/common/xxpath1xx/xxpath2xx/xxpath3xx/xxfile.class.phpxx
+++ b/common/xxpath1xx/xxpath2xx/xxpath3xx/xxfile.class.phpxx
@@ -2121,8 +2121,4 @@
+
+ public function dummy() {
+ echo 'This is a dummy f()';
+ }
}
#push the changes, and verify
git log origin/development..origin/hotfix/RGD-0000-BLABLA --oneline --no-merges
65243a1ac08 (HEAD -> hotfix/RGD-0000-BLABLA, origin/hotfix/RGD-0000-BLABLA) test
# at this moment we have only 1 change (1 file) between development and our branch
# generate code coverage report to use in sonar
/usr/bin/php -d memory_limit=-1 /xxPROJxx/vendor/bin/phpunit --coverage-clover /var/tmp/coverage_report.xml --log-junit /var/tmp/tests_report.xml
PHPUnit 9.3.11 by Sebastian Bergmann and contributors.
# run sonar with
/sonar-scanner-4.4.0.2170-linux/bin/sonar-scanner -Dsonar.verbose=true -Dsonar.login=xxsonarcredsxx -Dsonar.pullrequest.branch=hotfix/RGD-0000-BLABLA -Dsonar.pullrequest.key=30768 -Dsonar.pullrequest.base=development
09:17:07.193 INFO: SonarScanner 4.4.0.2170
09:17:07.195 INFO: Java 13.0.1 Oracle Corporation (64-bit)
09:17:07.195 INFO: Mac OS X 10.16 x86_64
09:17:08.118 INFO: Analyzing on SonarCloud
09:17:08.710 INFO: Load global settings
09:17:09.049 INFO: Load global settings (done) | time=339ms
09:17:09.057 INFO: Server id: 1BD809FA-AWHW8ct9-T_TB3XqouNu
09:17:09.075 INFO: Load/download plugins
09:17:09.076 INFO: Load plugins index
09:17:09.384 INFO: Load plugins index (done) | time=307ms
09:17:09.656 INFO: Load/download plugins (done) | time=581ms
09:17:10.140 INFO: Loaded core extensions: developer-scanner
09:17:10.723 INFO: Load project settings for component key: 'xxx'
09:17:10.990 INFO: Load project settings for component key: 'xxx' (done) | time=267ms
09:17:10.994 INFO: Process project properties
09:17:11.002 INFO: Execute project builders
09:17:11.004 INFO: Execute project builders (done) | time=1ms
09:17:11.006 INFO: Project key: xxx
09:17:18.854 INFO: Load project branches
09:17:19.138 INFO: Load project branches (done) | time=284ms
09:17:19.141 INFO: Check ALM binding of project 'xxx'
09:17:19.393 INFO: Detected project binding: BOUND
09:17:19.393 INFO: Check ALM binding of project 'xxx' (done) | time=252ms
09:17:19.395 INFO: Load project pull requests
09:17:19.946 INFO: Load project pull requests (done) | time=551ms
09:17:19.948 INFO: Load branch configuration
09:17:20.369 INFO: Load branch configuration (done) | time=421ms
09:17:20.398 INFO: Load quality profiles
09:17:20.720 INFO: Load quality profiles (done) | time=322ms
09:17:20.725 INFO: Load active rules
09:17:23.977 INFO: Load active rules (done) | time=3252ms
09:17:24.029 INFO: Organization key: xxx
09:17:24.029 INFO: Pull request 30768 for merge into development from hotfix/RGD-0000-BLABLA
09:17:24.046 INFO: Load project repositories
09:17:25.841 INFO: Load project repositories (done) | time=1795ms
09:17:25.842 INFO: SCM collecting changed files in the branch
09:17:26.635 INFO: SCM collecting changed files in the branch (done) | time=793ms
09:17:26.659 INFO: Indexing files...
09:17:26.660 INFO: Project configuration:
09:17:26.660 INFO: Excluded sources: xxx
09:17:26.660 INFO: Excluded sources for coverage: xxx
09:17:26.660 INFO: Excluded sources for duplication: xxx
09:17:36.661 INFO: 6013 files indexed... (last one was xxx)
09:17:46.662 INFO: 14669 files indexed... (last one was xxx)
09:17:54.008 INFO: 20605 files indexed
09:17:54.008 INFO: 11705 files ignored because of inclusion/exclusion patterns
09:17:54.008 INFO: 17 files ignored because of scm ignore settings
09:17:54.009 INFO: Quality profile for js: Sonar way
09:17:54.009 INFO: Quality profile for json: SonarQube Way
09:17:54.009 INFO: Quality profile for php: RG - PHP
09:17:54.009 INFO: Quality profile for web: RG - HTML
09:17:54.009 INFO: Quality profile for yaml: Sonar way
09:17:54.145 INFO: ------------- Run sensors on module xxx
09:17:54.303 INFO: Load metrics repository
09:17:54.577 INFO: Load metrics repository (done) | time=274ms
09:17:57.250 INFO: Sensor IaC CloudFormation Sensor [iac]
09:17:57.510 INFO: 0 source files to be analyzed
09:17:57.569 INFO: 0/0 source files have been analyzed
09:17:57.569 INFO: Sensor IaC CloudFormation Sensor [iac] (done) | time=320ms
09:17:57.569 INFO: Sensor IaC Kubernetes Sensor [iac]
09:17:57.642 INFO: 0 source files to be analyzed
09:17:57.724 INFO: 0/0 source files have been analyzed
09:17:57.724 INFO: Sensor IaC Kubernetes Sensor [iac] (done) | time=155ms
09:17:57.725 INFO: Sensor C# Project Type Information [csharp]
09:17:57.735 INFO: Sensor C# Project Type Information [csharp] (done) | time=10ms
09:17:57.735 INFO: Sensor C# Analysis Log [csharp]
09:17:57.754 INFO: Sensor C# Analysis Log [csharp] (done) | time=19ms
09:17:57.755 INFO: Sensor C# Properties [csharp]
09:17:57.755 INFO: Sensor C# Properties [csharp] (done) | time=0ms
09:17:57.755 INFO: Sensor HTML [web]
09:17:57.755 INFO: Sensor HTML is restricted to changed files only
09:17:58.376 INFO: Sensor HTML [web] (done) | time=621ms
09:17:58.376 INFO: Sensor Text Sensor [text]
09:17:58.385 INFO: 20500 source files to be analyzed
09:18:08.390 INFO: 18126/20500 files analyzed, current file: xxx
09:18:10.358 INFO: 20500/20500 source files have been analyzed
09:18:10.358 INFO: Sensor Text Sensor [text] (done) | time=11982ms
09:18:10.358 INFO: Sensor VB.NET Project Type Information [vbnet]
09:18:10.366 INFO: Sensor VB.NET Project Type Information [vbnet] (done) | time=8ms
09:18:10.366 INFO: Sensor VB.NET Analysis Log [vbnet]
09:18:10.385 INFO: Sensor VB.NET Analysis Log [vbnet] (done) | time=19ms
09:18:10.385 INFO: Sensor VB.NET Properties [vbnet]
09:18:10.386 INFO: Sensor VB.NET Properties [vbnet] (done) | time=1ms
09:18:10.386 INFO: Sensor JaCoCo XML Report Importer [jacoco]
09:18:10.419 INFO: 'sonar.coverage.jacoco.xmlReportPaths' is not defined. Using default locations: target/site/jacoco/jacoco.xml,target/site/jacoco-it/jacoco.xml,build/reports/jacoco/test/jacocoTestReport.xml
09:18:10.419 INFO: No report imported, no coverage information will be imported by JaCoCo XML Report Importer
09:18:10.419 INFO: Sensor JaCoCo XML Report Importer [jacoco] (done) | time=33ms
09:18:10.420 INFO: Sensor JavaScript analysis [javascript]
09:18:20.413 INFO: 66 source files to be analyzed
09:18:24.174 INFO: 66/66 source files have been analyzed
09:18:24.175 INFO: Hit the cache for 0 out of 66
09:18:24.175 INFO: Miss the cache for 66 out of 66: FILE_NOT_IN_CACHE [66/66]
09:18:24.176 INFO: Sensor JavaScript analysis [javascript] (done) | time=13755ms
09:18:24.176 INFO: Sensor TypeScript analysis [javascript]
09:18:24.186 INFO: No input files found for analysis
09:18:24.186 INFO: Hit the cache for 0 out of 0
09:18:24.186 INFO: Miss the cache for 0 out of 0
09:18:24.186 INFO: Sensor TypeScript analysis [javascript] (done) | time=10ms
09:18:24.187 INFO: Sensor JavaScript inside YAML analysis [javascript]
09:18:24.192 INFO: 12 source files to be analyzed
09:18:24.290 INFO: 12/12 source files have been analyzed
09:18:24.290 INFO: Hit the cache for 0 out of 12
09:18:24.290 INFO: Miss the cache for 12 out of 12: FILE_NOT_IN_CACHE [12/12]
09:18:24.290 INFO: Sensor JavaScript inside YAML analysis [javascript] (done) | time=103ms
09:18:24.290 INFO: Sensor CSS Rules [javascript]
09:18:24.290 INFO: Sensor CSS Rules is restricted to changed files only
09:18:24.309 INFO: 289 source files to be analyzed
09:18:26.453 INFO: 289/289 source files have been analyzed
09:18:26.453 INFO: Hit the cache for 0 out of 0
09:18:26.453 INFO: Miss the cache for 0 out of 0
09:18:26.453 INFO: Sensor CSS Rules [javascript] (done) | time=2163ms
09:18:26.454 INFO: Sensor ThymeLeaf template sensor [securityjavafrontend]
09:18:26.509 INFO: Sensor ThymeLeaf template sensor [securityjavafrontend] (done) | time=55ms
09:18:26.510 INFO: Sensor PHP sensor [php]
09:18:26.540 INFO: Starting PHP symbol indexer
09:18:26.543 INFO: 20386 source files to be analyzed
09:18:36.548 INFO: 577/20386 files analyzed, current file: xxx
09:18:46.550 INFO: 1363/20386 files analyzed, current file: xxx
...........................................
09:23:03.611 INFO: 20386/20386 source files have been analyzed
09:23:03.628 INFO: Starting PHP rules
09:23:03.631 INFO: 20386 source files to be analyzed
09:23:13.636 INFO: 211/20386 files analyzed, current file: xxx
09:23:23.638 INFO: 451/20386 files analyzed, current file: xxx
...........................................
09:37:24.036 INFO: 20211/20386 files analyzed, current file: xxx
09:37:31.251 WARN: Failed to resolve 1 include/require statements like 'xxx' from 'admin'
09:37:31.282 INFO: 20386/20386 source files have been analyzed
09:37:31.288 INFO: Importing /var/tmp/tests_report.xml
09:37:31.501 WARN: Test cases must always be descendants of a file-based suite, skipping : xxx in xxx
09:37:31.501 WARN: Test cases must always be descendants of a file-based suite, skipping : xxx in xxx
09:37:31.502 WARN: Test cases must always be descendants of a file-based suite, skipping : xxx in xxx
09:37:34.701 INFO: Importing /var/tmp/coverage_report.xml
09:37:39.070 INFO: Sensor PHP sensor [php] (done) | time=1152560ms
09:37:39.071 INFO: Sensor Analyzer for "php.ini" files [php]
09:37:39.135 INFO: Sensor Analyzer for "php.ini" files [php] (done) | time=64ms
09:37:39.135 INFO: Sensor Serverless configuration file sensor [security]
09:37:39.147 INFO: 0 Serverless function entries were found in the project
09:37:39.151 INFO: 0 Serverless function handlers were kept as entrypoints
09:37:39.152 INFO: Sensor Serverless configuration file sensor [security] (done) | time=17ms
09:37:39.152 INFO: Sensor AWS SAM template file sensor [security]
09:37:39.175 INFO: Sensor AWS SAM template file sensor [security] (done) | time=23ms
09:37:39.175 INFO: Sensor javabugs [dbd]
09:37:39.181 INFO: No IR files have been included for analysis.
09:37:39.181 INFO: Sensor javabugs [dbd] (done) | time=6ms
09:37:39.182 INFO: Sensor pythonbugs [dbd]
09:37:39.184 INFO: No IR files have been included for analysis.
09:37:39.184 INFO: Sensor pythonbugs [dbd] (done) | time=2ms
09:37:39.184 INFO: Sensor JavaSecuritySensor [security]
09:37:39.185 INFO: Read 0 type definitions
09:37:39.188 INFO: No UCFGs have been included for analysis.
09:37:39.188 INFO: Sensor JavaSecuritySensor [security] (done) | time=4ms
09:37:39.188 INFO: Sensor CSharpSecuritySensor [security]
09:37:39.191 INFO: Read 0 type definitions
09:37:39.191 INFO: No UCFGs have been included for analysis.
09:37:39.191 INFO: Sensor CSharpSecuritySensor [security] (done) | time=3ms
09:37:39.192 INFO: Sensor PhpSecuritySensor [security]
09:37:42.178 INFO: Read 14326 type definitions
09:38:34.727 INFO: 09:38:34.726709 Running Tarjan on 738756 nodes
09:38:35.558 INFO: 09:38:35.557777 Tarjan found 735515 components
09:38:37.872 INFO: 09:38:37.872773 Variable type analysis: done
09:38:37.873 INFO: 09:38:37.873467 Building Runtime Type propagation graph
09:39:16.666 INFO: 09:39:16.665779 Running Tarjan on 924769 nodes
09:39:20.704 INFO: 09:39:20.704473 Tarjan found 891184 components
09:39:28.165 INFO: Skipping component with 31331 elements and 2189 types
09:39:36.019 INFO: 09:39:36.019446 Variable type analysis: done
09:39:36.021 INFO: 09:39:36.02122 Building Runtime Type propagation graph
09:40:42.698 INFO: 09:40:42.697735 Running Tarjan on 918516 nodes
09:40:47.004 INFO: 09:40:47.004148 Tarjan found 872306 components
09:40:53.451 INFO: Skipping component with 40899 elements and 1796 types
09:40:55.297 INFO: 09:40:55.29733 Variable type analysis: done
09:40:55.383 INFO: Analyzing 103649 ucfgs to detect vulnerabilities.
09:42:41.602 INFO: All rules entrypoints : 2088
09:42:41.602 INFO: Retained UCFGs : 19873
09:42:43.610 INFO: Taint analysis starting. Entrypoints: 2088
09:42:43.636 INFO: Running symbolic analysis for 'PHP'
at 193:74 - 194:105
at 183:79 - 183:179
at 90:28 - 90:95
at 91:28 - 91:95
at 92:28 - 92:95
at 93:49 - 93:116
at 128:107 - 128:160
at 179:71 - 197:5
at 61:22 - 61:124
at 64:22 - 64:123
at 68:22 - 68:131
at 140:22 - 140:124
at 143:22 - 143:123
at 147:22 - 147:131
at 29:74 - 29:170
at 30:70 - 35:33
at 87:31 - 87:58
at 75:70 - 80:17
at 53:34 - 54:61
at 66:34 - 68:40
at 91:167 - 91:320
at 100:166 - 100:313
at 30:89 - 30:135
at 127:90 - 127:147
at 54:91 - 54:165
at 231:54 - 231:121
at 25:114 - 25:184
at 25:285 - 25:351
at 460:49 - 460:155
at 462:49 - 462:148
at 463:49 - 463:148
at 464:49 - 464:150
at 465:49 - 465:149
at 95:140 - 95:163
at 165:25 - 165:54
at 222:28 - 222:57
at 198:145 - 198:165
at 165:25 - 165:54
at 222:28 - 222:57
at 198:145 - 198:165
at 165:25 - 165:54
at 222:28 - 222:57
at 198:145 - 198:165
at 165:25 - 165:54
at 222:28 - 222:57
at 198:145 - 198:165
at 820:71 - 820:117
at 85:12 - 88:13
at 151:16 - 151:142
at 551:16 - 551:47
at 552:16 - 552:37
at 470:12 - 470:85
at 101:36 - 101:83
at 111:36 - 111:83
} .
array: Y(this.positions, object: D(thisVar: _this_(rg_uielement_formschema), ucfgId: rg_uielement_formschema::getglobalerrors ) )
dim(0): M(value: "" )
} .
array: Y(this.positions, object: D(thisVar: _this_(rg_uielement_formschema), ucfgId: rg_uielement_formschema::getglobalerrors ) )
dim(0): M(value: "" )
} .
at 542:8 - 542:28
at 27:29 - 27:68 ) {
}], type: ) {
H(value: _SONAR_WILDCARD_146 ) = Flow([<history>: ] M(value: "" ) )
M(value: "name" ) = Flow([<history>: ] E(id: 2685, instruction: vcall %7 = get[NO-DEFAULT] (%5, "ssoSettings", %6)
at 27:29 - 27:68 ) {
})
M(value: "type" ) = Flow([<history>: ] E(id: 2685, instruction: vcall %7 = get[NO-DEFAULT] (%5, "ssoSettings", %6)
at 27:29 - 27:68 ) {
})
}' produced a symbol of a different class: 'K(TAINTSOURCES = [E(SANITIZED = [COMMAND_INJECTION, LDAP_INJECTION, PATH_INJECTION, XPATH_INJECTION, REGEX_DOS, SQL_INJECTION, REFLECTED_XSS, DESERIALIZATION, SERVER_SIDE_REQUEST, LOG_INJECTION, HTTP_REDIRECT, NOSQL_INJECTION, HEADER_INJECTION, CODE_INJECTION, INCLUDE_INJECTION, DOM_XSS, ARGUMENT_INJECTION, ZIP_SLIP, DOM_OPEN_REDIRECT, REFLECTION_INJECTION, SESSION_FIXATION, ARGUMENT_CONSTRUCTION, INTENT_REDIRECTION, THREAD_SUSPENSION_DOS, JSON_OPERATIONS, XML_OPERATIONS], id: 2685, instruction: vcall %7 = get[NO-DEFAULT] (%5, "ssoSettings", %6)
at 27:29 - 27:68 ) {
}], SANITIZED = [COMMAND_INJECTION, LDAP_INJECTION, PATH_INJECTION, XPATH_INJECTION, REGEX_DOS, SQL_INJECTION, REFLECTED_XSS, DESERIALIZATION, SERVER_SIDE_REQUEST, LOG_INJECTION, HTTP_REDIRECT, NOSQL_INJECTION, HEADER_INJECTION, CODE_INJECTION, INCLUDE_INJECTION, DOM_XSS, ARGUMENT_INJECTION, ZIP_SLIP, DOM_OPEN_REDIRECT, REFLECTION_INJECTION, SESSION_FIXATION, ARGUMENT_CONSTRUCTION, INTENT_REDIRECTION, THREAD_SUSPENSION_DOS, JSON_OPERATIONS, XML_OPERATIONS], type: ) {
H(value: _SONAR_WILDCARD_146 ) = Flow([<history>: ] M(value: "" ) )
M(value: "name" ) = Flow([<history>: ] E(SANITIZED = [COMMAND_INJECTION, LDAP_INJECTION, PATH_INJECTION, XPATH_INJECTION, REGEX_DOS, SQL_INJECTION, REFLECTED_XSS, DESERIALIZATION, SERVER_SIDE_REQUEST, LOG_INJECTION, HTTP_REDIRECT, NOSQL_INJECTION, HEADER_INJECTION, CODE_INJECTION, INCLUDE_INJECTION, DOM_XSS, ARGUMENT_INJECTION, ZIP_SLIP, DOM_OPEN_REDIRECT, REFLECTION_INJECTION, SESSION_FIXATION, ARGUMENT_CONSTRUCTION, INTENT_REDIRECTION, THREAD_SUSPENSION_DOS, JSON_OPERATIONS, XML_OPERATIONS], id: 2685, instruction: vcall %7 = get[NO-DEFAULT] (%5, "ssoSettings", %6)
at 27:29 - 27:68 ) {
})
M(value: "type" ) = Flow([<history>: ] E(SANITIZED = [COMMAND_INJECTION, LDAP_INJECTION, PATH_INJECTION, XPATH_INJECTION, REGEX_DOS, SQL_INJECTION, REFLECTED_XSS, DESERIALIZATION, SERVER_SIDE_REQUEST, LOG_INJECTION, HTTP_REDIRECT, NOSQL_INJECTION, HEADER_INJECTION, CODE_INJECTION, INCLUDE_INJECTION, DOM_XSS, ARGUMENT_INJECTION, ZIP_SLIP, DOM_OPEN_REDIRECT, REFLECTION_INJECTION, SESSION_FIXATION, ARGUMENT_CONSTRUCTION, INTENT_REDIRECTION, THREAD_SUSPENSION_DOS, JSON_OPERATIONS, XML_OPERATIONS], id: 2685, instruction: vcall %7 = get[NO-DEFAULT] (%5, "ssoSettings", %6)
at 27:29 - 27:68 ) {
})
}'. Attempting to continue with the original symbol.
at 213:19 - 213:48
at 213:19 - 213:48
at 213:19 - 213:48
at 213:19 - 213:48
09:43:10.049 INFO: Taint analysis: done.
09:43:10.049 INFO: Sensor PhpSecuritySensor [security] (done) | time=330857ms
09:43:10.052 INFO: Sensor PythonSecuritySensor [security]
09:43:10.058 INFO: Read 0 type definitions
09:43:10.058 INFO: No UCFGs have been included for analysis.
09:43:10.058 INFO: Sensor PythonSecuritySensor [security] (done) | time=6ms
09:43:10.058 INFO: Sensor JsSecuritySensor [security]
09:43:10.062 INFO: Read 0 type definitions
09:43:10.170 INFO: 09:43:10.17064 Building Runtime Type propagation graph
09:43:10.174 INFO: 09:43:10.174876 Running Tarjan on 465 nodes
09:43:10.175 INFO: 09:43:10.175352 Tarjan found 465 components
09:43:10.176 INFO: 09:43:10.176119 Variable type analysis: done
09:43:10.176 INFO: 09:43:10.176258 Building Runtime Type propagation graph
09:43:10.179 INFO: 09:43:10.179442 Running Tarjan on 465 nodes
09:43:10.179 INFO: 09:43:10.179762 Tarjan found 465 components
09:43:10.180 INFO: 09:43:10.180107 Variable type analysis: done
09:43:10.180 INFO: Analyzing 107 ucfgs to detect vulnerabilities.
09:43:10.230 INFO: Taint analysis starting. Entrypoints: 34
09:43:10.230 INFO: Running symbolic analysis for 'JS'
09:43:10.521 INFO: Taint analysis: done.
09:43:10.521 INFO: Sensor JsSecuritySensor [security] (done) | time=463ms
09:43:10.530 INFO: ------------- Run sensors on project
09:43:10.614 INFO: Sensor Analysis Warnings import [csharp]
09:43:10.615 INFO: Sensor Analysis Warnings import [csharp] (done) | time=1ms
09:43:10.616 INFO: Sensor Zero Coverage Sensor
09:43:13.452 INFO: Sensor Zero Coverage Sensor (done) | time=2836ms
09:43:13.468 INFO: SCM Publisher SCM provider for this project is: git
09:43:13.473 INFO: SCM Publisher 392 source files to be analyzed
09:43:14.211 INFO: Blaming files using native implementation
09:43:23.476 INFO: 144/392 source files have been analyzed
09:43:33.476 INFO: 285/392 source files have been analyzed
09:43:39.724 INFO: Blaming files using native implementation (done) | time=25513ms
09:43:39.731 INFO: SCM Publisher 392/392 source files have been analyzed (done) | time=26257ms
09:43:40.755 INFO: CPD Executor 3377 files had no CPD blocks
09:43:40.756 INFO: CPD Executor Calculating CPD for 13356 files
09:43:49.030 INFO: CPD Executor CPD calculation finished (done) | time=8274ms
09:44:00.145 INFO: SCM writing changed lines
09:44:04.358 INFO: SCM writing changed lines (done) | time=4213ms
09:44:06.332 INFO: Analysis report generated in 15558ms, dir size=24 MB
09:44:44.709 INFO: Analysis report compressed in 38377ms, zip size=18 MB
09:44:51.605 INFO: Analysis report uploaded in 6894ms
09:44:51.608 INFO: ANALYSIS SUCCESSFUL, you can find the results at: https://sonarcloud.io/dashboard?id=xxxxx&pullRequest=30768
09:44:51.608 INFO: Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
09:44:51.608 INFO: More about the report processing at https://sonarcloud.io/api/ce/task?id=xxxx
09:45:05.479 INFO: Analysis total time: 27:55.338 s
09:45:05.508 INFO: ------------------------------------------------------------------------
09:45:05.508 INFO: EXECUTION SUCCESS
09:45:05.508 INFO: ------------------------------------------------------------------------
09:45:05.508 INFO: Total time: 27:58.391s
09:45:06.096 INFO: Final Memory: 142M/484M
09:45:06.096 INFO: ------------------------------------------------------------------------
In this case again i can see a lot more files being shown as changed in the sonar cloud UI than realistically changed.
Hopefully that is enough information, let me know if you need anything else.