SonarQube 8.9 LTS does not analyze files in paths with certain package names (like "build")

SonarQube
,
#1

This is not an issue with a specific rule but with the SonarQube analysis itself.

We have noticed that since our migration from SonarQube 6.7 to 8.9 LTS, a whole lot of files from certain packages seem to have completely vanished from the analysis. We have no specific inclusions or exclusions of source files and use the default settings of the Gradle analyzer.

According to our testing, the files that went missing in the SonarQube UI all share specific package names like

  • build
  • update
  • target

and renaming the packages to something else caused them to be included again in the analysis.

Example:

  • src/main/java/com/mycompany/gradle/plugins/build/jarsigning is present in 6.7 and missing in 8.9.
  • src/main/java/com/mycompany/gradle/plugins/utils/livereload is present in both versions.

Could the cause be some overzealous filtering that attempts to prevent accidental inclusion of compilation output into the analysis?

#2

Hi,

I wouldn’t call it “overzealous”. :smiley:

But quite a bit has changed between 6.7 and 8.9, and that does include some “smart” exclusions. :wink:

Specifically, I’m guessing you’re impacted by the exclusion of files you’ve set your SCM to ignore. You can turn that behavior back off with the sonar.scm.exclusions.disabled parameter. (The docs.)

 
HTH,
Ann

#3

We tried setting sonar.scm.exclusions.disabled=true in the root project as well as in individual projects, but neither seems to have had any affect.

Furthermore, our .gitignore contains the following rules with regards to the build folder:

**/build/
!**/src/**/build/

So while regular build folders are indeed ignored, those that are part of src folders should still be kept according to Git.

#4

Hi,

Could you add -Dsonar.scanner.dumpToFile=[path to file] to your analysis command so we can see the parameter values the scanner is working with?

 
Ann

#6

I checked our metrics again myself and it seems like our engineers didn’t look properly. :slight_smile:
When they tried out the property you suggested on June 10th, our analysis actually started including ~90 more files than before, which all happen to be in the build folder.

One could still argue that even with the property disabled, the exclusion in the .gitignore file should be overruled for these specific files by the inclusion further down. Maybe there’s room for improvement in whatever tooling is handling this smart exclusion, but disabling it is good enough for us at the moment. :wink:

1 Like
#7

Hi,

Thanks for the update! Would you mind sharing your other inclusion/exclusion settings, please?

 
Thx
Ann

#8

You mean for the Sonar analysis? That one just uses the default settings of the Gradle Scanner. We do not actually configure any inclusions/exclusions.

Or are you referring to the .gitignore file?

#9

Hi,

That’s what I wanted to know. Thanks!

 
Ann

#10

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.