SonarQube does not find new bugs in PRs, until they are merged to master

[Laurie_Dening]

@ganncamp

The workaround would be to analyze the PR’s underlying branch

do you have a link that explains how to do this?

[ganncamp (G Ann Campbell)]

Hi @Laurie_Dening,

Welcome to the community!

You’re looking for the branch analysis docs.

 
HTH,
Ann

[dima1308 (Dmitry Grinberg)]

@Laurie_Dening

do you have a link that explains how to do this?

Please see my previous comment about this workaround:

@dima1308

Yes, this is what we do, but it leads to additional problems. For example, if an issue is detected by Sonar during scanning the feature branch and if the SW engineer will mark this issue as a false positive, after the PR merge the same false positive issue will not be marked in the main branch and next Sonar scan of the main branch will fail.

[Will97 (Wang)]

Hi,
Have you solved this problem? I also encountered the same bug, thanks.

[dima1308 (Dmitry Grinberg)]

Hi Wang,

Unfortunately, Sonar decided not to fix this issue. They call it a feature and the request to solve it is open for an extremely long time.
May I ask you to vote for fixing this issue here (and mark it as critical) https://portal.productboard.com/sonarsource/3-sonarqube/c/171-prs-show-issues-that-will-be-fixed-by-the-merge?

[Will97 (Wang)]

@dima1308

mark it as critica

Thanks for the suggestion, I have marked it as critica

[leluna]

As Dmitry Grinberg stated, the reliability is so much more important for us than the speed. The single reason why we even run SonarQube analysis in PR is to prevent potential bugs / code smell to even get merged. It totally defeats the purpose if the problems only get detected after merge.

I think the definition of PR analysis is really flawed. The code analysis should analyze the impact of the new code, not only the new code. This is also true for duplication. Whereas test coverage should apply to only the new code.

Dmitry Grinberg already pointed out why a solution is still needed instead of analyzing the underlying branch. It is 2026 and the card is absolutely the most rated card on the board. Do you need any other indicator to understand that this issue is critical?