Sonarcloud :: GO :: exclusions defined in UI's General Settings are no longer respected

SonarCloud
,
1
  • ALM used: Bitbucket Cloud
  • CI system: used Circle CI
  • Language of the repository: GO
  • Error observed
    • When running a GO analysis with GO exclusions defined in the Sonarcloud UI, they are not respected, leading to analysis warnings in excluded files
  • Steps to reproduce
    • Set a Go Exclusion of **_test.go for a repository through General Settings → Languages → GO → Go Exclusions
    • Have duplicate code or some other static analysis warning present in test files
    • Run static analysis
    • Observe warnings are shown in excluded files
  • Potential workaround
    • set the following rule in the sonarcloud-project.properties file in the repo:
sonar.sources=.
sonar.exclusions=**/*_test.go

We’ve been setting our go file exclusions via the UI without issue. In the last 48 hours or so, we’ve started seeing unexpected analysis warnings in files we’re excluding. We have a workaround by setting the rules in the sonarcloud-project.properties file which is good. However, I’d like to see if I’m misunderstanding the usage of the General Settings or some interplay between the .properties file and the UI.

One final detail I’ll add is that it seems like some configurations in the UI are being respected. For example, we have the Path to coverage report(s) defined solely in the UI as coverage/coverage.out and it seems like Sonarcloud is finding this configuration and returning the coverage we would expect to see. I tried to find some documentation on how precedence works between the UI and the .properties file but came up empty. Does one take precedence over the other? Are the configurations “merged” in some way?

Any insight is appreciated, thanks!

2

Hi,

Welcome to the community!

Is your Go exclusion actually **_test.go? Because that (versus **/*_test.go) wouldn’t be a valid exclusion.

 
Ann

4

Hello I will second this, as we’ve started seeing the same thing since ~1 month ago (cant find exact date, but last successful scan was September 21st) we had not changed the default value of “sonar.go.exclusions”

image
image1576×340 25.8 KB

But for some reason all subsequent scans(after ~September 21st] started including the whole vendor in the analysis, meaning we hit our plan limit by 1 scan.

And the project → Administration → Background tasks → Show Scanner Context still shows that it has

sonar.go.exclusions=**/vendor/**

Another interesting detail is that the “Go Code Quality and Security 1.14.0.4481 (go)” plugin is not longer being loaded. Are you aware of any changes that would have affected this?

But as stated by Brad, we can aslo get around this by directly specifying

sonar.exclusions=**/vendor/**

6

Hi @Karl_Gronberg,

Welcome to the community and thanks for these details!

We merged a fix for this problem today and expect it to be deployed tomorrow. If you’re still seeing this by Thursday, could you let us know, please?

 
Thx,
Ann

1 Like