SonarQube Cloud Scan Not Working + Cannot perform Full Code Scan

SonarQube Cloud
1

Hi there, we are trying to onboard SonarQube Cloud in our Azure DevOps tenant.
We installed the extension in ADO, and followed the steps to modify our pipeline with the sonar steps. When the build runs, the scan reports 0 files to be scanned, even if we change any of the files. Also, we are not able to figure out how to force a full scan of the repo, instead of scanning only the new code.

Follows the changes we did in our pipeline (secrets omitted):

                - checkout: self
                  fetchDepth: 0

                - task: SonarCloudPrepare@3
                  inputs:
                    SonarQube: 'SonarQube Cloud'
                    organization: '<org-key>'
                    scannerMode:  'cli'
                    configMode: 'manual'
                    cliProjectKey: '<project-key>'
                    cliProjectName: '<project-name>'
                    cliSources: '$(Build.SourcesDirectory)/dist/dev'

(BUILD TASKS)

                - task: SonarCloudAnalyze@3
                  inputs:
                    jdkversion: 'JAVA_HOME_21_X64'

When accessing the sonarcloud portal, we can see the new commits and there, so we guess the integration is not an issue. To configure the projects (currently 2), we followed the guide provided in the portal when creating a new project.

Can you help out please?

  • ALM used: Azure DevOps
  • CI system used: Azure DevOps
  • Scanner command used when applicable (private details masked)
  • Languages of the repository: Typescript, Nexjs
  • Error observed (wrap logs/code around with triple quotes ``` for proper formatting)
  • Steps to reproduce

Thanks

2

Hi there,

after some attempts, we noticed a few things:

  • Using cliSources with ADO build variables (e.g. ‘$(Build.SourcesDirectory)’) doesnt work. We had to use relative paths (e.g. ‘./src’) to make it work
  • Non-Main branches will only scan new code, correct?
  • Updated files only highlight issues identified in new code, not on the existing code. Is there a setting we can use to highlight all issues identified in the modified file?

Thanks.

3

Hi,

Welcome to the community!

Could you share your full analysis log?

The analysis / scanner log is what’s output from the analysis command. Hopefully, the log you provide - redacted as necessary - will include that command as well.

This guide will help you find them.

 
Thx,
Ann

4

Hi G Ann,

thanks for the response.
We were able to fix the problem with the code scan (invalid configuration on the cliSources).
But as per my last comment, we have a few questions pending:

  • Non-Main branches will only scan new code, correct?
  • Updated files only highlight issues identified in new code, not on the existing code. Is there a setting we can use to highlight all issues identified in the modified file?

Is this something you could help with?

Thanks

5

Hi,

Well… Short-lived branches only analyze new code, but you can have as many long-lived branches as you like, and they analyze all code.

Note that a branch’s … “lifespan”? (short- or long-lived) is set the first time it’s analyzed and is immutable. If the setup was wrong on that first analysis, you’ll need to delete the branch and reanalyze.

What you’re describing is a new code analysis, whether in a short-lived branch or a PR. To see all issues, make sure you’re running a full branch analysis on a long-lived branch.

 
HTH,
Ann

6

Hi @ganncamp,

thanks for the update.
In this case, we have short-lived branches (feature/bug branches) and whenever someone updates a code file with new code, we would expect the analysis to show all issues with new and existing code, so then the person can understand the issues and fix them.

Isn’t this possible?
Realistically, we have our main branch (long-lived) currently analyzed, and with issues reported. But we are not going to fix all issues now. So, organically when devs modify code, they can fix existing and new issues, as long as we have them reported on the short-lived branches.

Thanks

7

Hi,

Again, short-lived branches only show issues in changed code. To get what you’re after, you’ll need to use long-lived branches.

 
HTH,
Ann