SonarQube not finding C code sources even when correctly configured: Sonarcloud + Github actions

Hello again,

From what I can tell, the build directory is "/app/Pre-Health/orthostat-base-station/build"
and one of the sources you are interested in is compiled with the path "../main/app_memfault.c", which resolves to "/app/Pre-Health/orthostat-base-station/main/app_memfault.c".

However, the scanner working dir is /home/runner/work/orthostat-base-station/orthostat-base-station.

This mismatch is causing the CFamily-plugin to be unable to cross-match the entry in the compilation database and the indexed files.

You are building inside docker and analyzing outside, right? That is usually problematic precisely because the environments are supposed to match since

  1. The location has to be the same as when building (or the files will not be cross-matched)
  2. The dependencies installed inside docker will not be available for the scanner, impacting the quality of the scan very negatively (there will be missing includes)

My suggestion would be to preferably run the scanner on the same docker container or on a new container that matches the build container (so the dependencies are available). However, keep in mind that we do not support musl-based distributions.

By the way, since you are already using cmake, you can save the middle step of using bear and straight ask CMake to generate the compilation database (CMAKE_EXPORT_COMPILE_COMMANDS).

Please, let me know if this helps.

1 Like