SonarQube Scanner for Maven isn't scanning Python code (sonar-maven-plugin)

[johnlinp (John Lin)]

I’m using SonarQube Scanner for Maven (sonar-maven-plugin) with version 3.9.1. When I run:

mvn sonar:sonar -Dsonar.login=<sonar-token>

against my project, it will run successfully. However, my Python code didn’t get scanned properly. From the logs, I can see that it invoked many sensors (Sensor HTML, Sensor C# Properties, Sensor VB.NET Properties, etc), but none of them are about Python.

I want to know the way to configure it to pickup my Python code. Thanks.

[Rebse (Gilbert Rebhan)]

Welcome

you have not written where in the directory structure your Python code is located, but i’m almost
sure it’s not part of the maven standard directory layout.
You will need to customize sonar.sources in the pom, see this posting with a similar problem
for further details

Mvn sonar:sonar doesn't scan angular files

Hey Colin, we didn’t set any sonar.sources, means those are set default. sonar.sources=E:\Jenkins\workspace\foobar\src\main\webapp,E:\Jenkins\workspace\foobar\pom.xml,E:\Jenkins\workspace\foobar\src\main\java It seems the Sonarqube Maven plugin is simply oriented to the Maven standard directory layout, see https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html So in our case we had to use <sonar.sources>src/main</sonar.sources> to target all files …

Gilbert

[johnlinp (John Lin)]

Hi Gilbert,

Thank you for your reply. Like you said, I didn’t put my Python code in standard Maven directory structure. Instead, I put my Python code inside a directory called “src”.

I tried to specify sonar.sources like you suggested. However, it didn’t work as expected, even I use a really broad config like **/src.

I suspect that the reason it didn’t work is not related to sonar.sources, but the “sensors” to scan the source code. For example, I see the logs contains the following lines:

INFO Sensor JaCoCo XML Report Importer ***jacoco*** (done) | time=1ms
INFO Sensor C# Properties ***csharp***
INFO Sensor C# Properties ***csharp*** (done) | time=1ms
INFO Sensor JavaXmlSensor ***java***
INFO Sensor JavaXmlSensor ***java*** (done) | time=0ms
INFO Sensor VB.NET Properties ***vbnet***
INFO Sensor VB.NET Properties ***vbnet*** (done) | time=0ms

Even though there are no C# or VB.NET code in my entire code base, it still runs the C# and VB.NET sensors. Therefore, I wonder if it’s because that the sensors for Python code are not there in the first place.

What do you think?

[Rebse (Gilbert Rebhan)]

Hi,

using Sonarqube 9.7.0 Enterprise, first test = sonar-maven-plugin:3.7.0.1746 and
second test = sonar-maven-plugin:jar:3.9.1.2184 just to be sure, Maven 3.8.6

Test with a Maven build, this src directory layout

\---src                
    +---main
    |   \---java
    |       \---com
    |           \---foo
    |               \---bar
    +---python
    \---test
        \---java
            \---com
                \---foo
                    \---bar

this sonar.sources property in pom.xml

  <properties>
    <sonar.sources>src</sonar.sources> 
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <maven.compiler.release>11</maven.compiler.release>
  </properties>

and it worked as expected, also scanning the python files.

Maybe you’re using another fileextension as configured in Sonarqube server !?
see https://yoursonarhost/admin/settings?category=Python
property sonar.python.file.suffixes

Gilbert