SonarLint does not resolve sonar.java.libraries correctly with Bazel IntelliJ plugin

  • Operating system: MacOS 14.4.1
  • IDE name and flavor/env: IntelliJ 2023.3.6
  • SonarQube server version: Version: 10.5.0.89998 Date: 2024-05-08 (Community)
  • SonarLint plugin version: 10.5.0.78339
  • Bazel Intellij plugin version: 2024.04.09.0.1-api-version-233

And a thorough description of the problem / question:
Scanning a Java file in a bazel project doesn’t seem to construct the ‘sonar.java.libraries’ property correctly. It contains a large number of jars, but these don’t seem to align with the dependency tree of the library containing the java file being scanned - it seems to be a random assortment of external dependency jars from maven, and internal module jars.

Even the jar for the current project isn’t included, leading to a large number of warning in the SonarLint logs:

- SomeOtherType cannot be resolved
  * [uri=file:///Users/me/repo/my_module/src/main/java/com/package/MyClass.java]

where SomeOtherType is defined in another java class within the same package.

IntelliJ is able to correctly resolve the dependencies provided by the Bazel IntelliJ plugin, as you can command+click through to source files in other modules/external dependencies.

Is there any insights into where this issue might be occurring? Presumably the Bazel IntelliJ plugin provides a dependency model which IntelliJ understands, but that doesn’t then map correctly to “sonar.java.libraries” in the SonarLint plugin.

Also, just to clarify if I manually construct the “sonar.java.libraries” attribute in the SonarLint plugin, analysis works as expected.

1 Like

Hello @Mitch_Just, thank you for raising this issue with us.

We do not officially support Bazel in the sense that we do not test SonarLint with Bazel. However, I have heard people have successfully used both.

The sonar.java.libraries is populated by default using the IntelliJ API, regardless of any tools used. So, I wouldn’t expect it to always work with Bazel out of the box.

One workaround would be to manually provide the right sonar.java.libraries property value.

We will try to have a look, but I would not expect any fixes in the short term.