SonarCloud PR analysis reporting coverage/issues on files not modified in the PR - AzureDevOps

SonarQube Cloud
, ,
1

SonarCloud PR analysis reporting coverage/issues on files not modified in the PR (AzureDevOps)

Hi Sonar Community,

We are seeing unexpected behavior in SonarCloud PR analysis where comments and coverage results are being reported for files/lines that were not modified by the pull request.

Environment

  • ALM: Azure DevOps

  • CI: Azure DevOps Pipelines

  • Language/Framework: .NET 10

  • Analysis: SonarCloud PR analysis

  • Quality Gate: New Code

Issue

In several recent PRs, SonarCloud has started reporting issues/coverage information against files that were not changed by the PR.

For example, a PR may modify only 4 files, but the SonarCloud analysis shows test coverage results and/or PR comments for additional files that were not touched by the PR.

Our expectation is that, since the Quality Gate is configured for New Code, the PR analysis should evaluate only code introduced or modified by the PR.

Repository Checkout

Before running SonarCloudPrepare@4, we perform a full Git checkout to ensure that SonarCloud has access to the complete repository history:

- checkout: self
  clean: true
  persistCredentials: true
  fetchDepth: 0

SonarCloud Configuration

The following properties are configured during the PR build:

sonar.projectBaseDir=$(System.DefaultWorkingDirectory)
sonar.scanner.skipJreProvisioning=true
sonar.cs.opencover.reportsPaths=$(Agent.TempDirectory)/**/coverage.opencover.xml
sonar.scanner.scanAll=false

sonar.exclusions=
sonar.coverage.exclusions=
sonar.test.inclusions=

sonar.scm.provider=git
sonar.scm.disabled=false

sonar.pullrequest.key=$(System.PullRequest.PullRequestId)
sonar.pullrequest.branch=$(System.PullRequest.SourceBranch)
sonar.pullrequest.base=$(System.PullRequest.TargetBranch)

Questions

Could you please help us understand:

  1. Why would SonarCloud consider files/lines that were not modified in the PR as part of the PR/New Code analysis?

  2. Is there any scenario where the coverage report can cause unchanged files to appear as new/changed code?

  3. Could this indicate that SonarCloud is unable to correctly determine the PR merge base or SCM diff?

  4. Are there any additional logs or scanner parameters we should check to confirm which commit SonarCloud is using as the comparison/base commit?

We have verified that fetchDepth: 0 is configured and have investigated the pipeline configuration, but so far we have not been able to determine why unchanged files are being included.

Any guidance on what we should check next would be appreciated.

Thanks!

2

Hey @sumandindaoptym, welcome to the Community! Do you see any warning in your logs? If you run the scanner with debug-level logs (sonar.verbose=true), do you see any logs mentioning potential issues with SCM/git?