SonarCloud posts branch analysis only in the comment section of Github PR (Pull Request), but it does not show up in Github PR check section

SonarCloud
1
  • Versions used (SonarQube, Scanner, Plugin, and any relevant extension)

SonarCloud, SonarScanner (sonar-scanner-msbuild-5.2.0.29862-net46)

  • Error observed

SonarCloud posts branch analysis only in the comment section of Github PR (Pull Request), but it does not show up in Github PR check section. Screenshot showing the issue: Imgur: The magic of the Internet

  • Steps to reproduce

In Teamcity or local machine,

  • Sonar scanner is started as such: (Note host url and login is set in config level)

SonarScanner.MSBuild.exe begin /o:"<organization>" /k:"<organization_project>" /d:sonar.pullrequest.key=<pr-id> /d:sonar.pullrequest.branch=<pr-branch> /d:sonar.pullrequest.base="develop" /d:sonar.verbose=true

  • Solution is compiled using Visual Studio Runner Type in Teamcity or in local as such:

MsBuild.exe /t:Rebuild

  • Sonar scanner is ended

SonarScanner.MSBuild.exe end

  • Potential workaround

No workaround known. We need to have SonarCloud hook into Github PR check to use it as our code analysis tool.

2

Hi @fredsakr-q4 , welcome to the community forum!

Could you please give us the logs produced by the Scanner during its analysis, in debug mode?
That would help us investigate.
If they contain private information, just give me that line of the logs, displayed at the end of the analysis:

More about the report processing at https://sonarcloud.io/api/ce/task?id=xxx

You can also send me a private message with the full logs if you prefer.

3

HI @Claire_Villard,
Thanks for reaching out. I am a developer in the same team as Fred.

The log line for report: https://sonarcloud.io/api/ce/task?id=AXkjs8Gbqh4oxxJ2keLo

Hoping to hearing from you soon.

4

Hi @Sunil_S

Thanks for the link.
The Check decoration got rejected because the SHA of the analyzed commit was not available to SonarCloud. The Check is associated with the commit SHA, not the PR itself.

The commit SHA is read from the Git context (.git directory) by the Sonar Scanner, during analysis.
This directory can be missing, for example if the sources are copied instead of cloned, or not readable.
Could you check your build pipeline for something like that?