SonarQube Cloud scan 4.1.0 hangs on minimal Python project in Bitbucket Pipelines

SonarQube Cloud
, ,
1

ALM used

Bitbucket Cloud

CI system used

Bitbucket Cloud Pipelines

Scanner

pipe: sonarsource/sonarcloud-scan:4.1.0

Scanner configuration:

sonar.python.version=3.12

Verbose logging is enabled using:

EXTRA_ARGS: >
  -Dsonar.python.version=3.12
  -Dsonar.verbose=true

Languages of the repository

Python 3.12.

This is a minimal test repository. The only Python source file is essentially:

print("Hello World")

The complete repository checkout, including .git, is approximately 200 KB.

There are no Python dependencies, virtual environments, build artifacts, node_modules, or other large directories.

SonarCloud project

The project is not public.

Error observed

The scan does not report an error. Instead, it stops making progress indefinitely.

The interesting part is that the point where it stops has changed between runs of the same minimal project.

One run stopped at:

INFO  Using 2 threads for analysis.
DEBUG Initializing SecretsStateContainer with specification loader.

After temporarily setting:

sonar.text.activate=false

the scanner progressed further but stopped at:

DEBUG Load UCFGs: Starting
DEBUG Reading UCFGs from: /opt/atlassian/pipelines/agent/build/.scannerwork/ucfg2/python

Another run stopped during Helm initialization:

DEBUG Initializing Helm processor
DEBUG Preparing Helm analysis for platform: linux-amd64

A later run progressed even further and stopped during Python bug detection:

INFO  Sensor pythonbugs [dbd]
DEBUG Bug detection sensor cache enabled for 'pythonbugs': true.
DEBUG DBD PR cache diagnostics for 'pythonbugs': the scanner requested a full analysis because unchanged files cannot be skipped.
DEBUG Cache key is missing: pythonbugs:bug_detection_cache_version
DEBUG DBD cache miss for 'pythonbugs': cached data version is missing (current version: '2.12.0.23863').
DEBUG Cache key is missing: pythonbugs:type_hierarchy_hash
DEBUG DBD cache miss for 'pythonbugs': type hierarchy hash changed (cached=null, current=3e4e42ca).
DEBUG Cache key is missing: pythonbugs:function_hashes
DEBUG DBD cache miss for 'pythonbugs': IR function hashes changed (cached=0, current=42, added=42, removed=0, changed=0).
DEBUG DBD PR cache decision for 'pythonbugs': canSkipUnchangedFiles=false, skipAnalysis=false, cacheVersionMatches=false, typeHierarchyMatches=false, functionHashesMatch=false, currentFunctionCount=42, cachedFunctionCount=0.
INFO  Analyzing 2/42 functions to detect bugs.

No further progress is observed.

Bitbucket Pipelines configuration

The relevant pipeline configuration is:

image: python:3.12

clone:
  depth: full

definitions:
  caches:
    sonar: ~/.sonar/cache

  services:
    docker:
      memory: 4096

  steps:
    - step: &build-test-sonarcloud
        name: Build, test and analyze on SonarCloud
        size: 2x
        services:
          - docker
        caches:
          - sonar
        script:
          - pipe: sonarsource/sonarcloud-scan:4.1.0
            variables:
              SONAR_TOKEN: $SONAR_TOKEN
              EXTRA_ARGS: >
                -Dsonar.python.version=3.12
                -Dsonar.verbose=true

pipelines:
  branches:
    main:
      - step: *build-test-sonarcloud

Steps to reproduce

  1. Create a minimal Bitbucket Cloud repository.

  2. Add a single program.py:

print("Hello World")
  1. Add:
sonar.python.version=3.12

to sonar-project.properties.

  1. Configure Bitbucket Pipelines to run:
pipe: sonarsource/sonarcloud-scan:4.1.0
  1. Run the pipeline with verbose Sonar logging enabled.

The scanner starts normally but eventually stops making progress during one of the analyzer phases.

Troubleshooting already performed

We have tested:

  • sonarsource/sonarcloud-scan:4.1.0

  • Python 3.12

  • Full Git clone

  • sonar.verbose=true

  • Bitbucket size: 2x

  • Docker service with 4096 MB memory

  • Disabling text/secrets analysis with sonar.text.activate=false

  • Confirming that the entire checkout is only approximately 200 KB

  • Confirming that there are no dependencies or generated source trees being analyzed

Increasing the Bitbucket step and Docker memory did not resolve the issue.

Disabling text/secrets analysis allowed the scan to progress beyond that sensor, but it subsequently stopped during another analyzer phase.

Potential workaround

No reliable workaround has been found.

Downgrading to sonarsource/sonarcloud-scan:2.0.0 was also tested, but that version fails because its environment uses Java 17:

java.lang.IllegalStateException: Java 17 is not supported.
Please upgrade to Java 21 or newer, or use JRE auto-provisioning...

At this point the issue appears reproducible with a minimal Python project.

Is there additional diagnostic information we can collect to determine why the scanner stops making progress, or is this a known issue with the current SonarCloud analyzer/scanner runtime?

Any help appreciated, thank you.
Frederik Vindum

2

Hey @frvingstdk, some initial ideas to try out in order to narrow down the issue:

  • Force the analysis to run in a single thread: pass -Dsonar.python.analysis.parallel=false to the Scanner pipe’s EXTRA_ARGS.
  • Disable the “dataflow bug detection” (aka pythonbugs) (aka DBD) rules: pass -Dsonar.dbd.enable=false. It seems like some of your runs get stuck here.
  • Enable Python performance timings and write them to a file: -Dsonar.python.performance.measure=true and -Dsonar.python.performance.measure.path=.scannerwork/python-perf.json (for example). Please share the file here.

The fact that it’s getting stuck at different points of the analysis is very strange, and this is why I’m suggesting to try and poke at the issue from multiple sides.

It would also be helpful for us if you could attach full debug-level logs for a few different runs where the analysis got stuck in different places.