I’m trying to setup sonarcloud for a on C++ cmake github through github actions. I’ve tried both the build wrapper and a compilation database but neither seem to be working as they aren’t identifying issues in my project that are reported locally with the vscode sonarlint extension.
How can I debug this? I’m probably making some basic silly mistake.
One thing I noticed in the --debug output from sonar-scanner is Plugins not loaded because they are optional: [cpp, kotlin], but I’m not sure if this is relevant. I am using the sonarsource/sonarcloud-github-c-cpp@v2 action.
Ok, I figured out the issue of the plugin not being loaded and files not being checked. There was a configuration issue on the sonarcloud.io page.
It still seems that sonarcloud isn’t reporting any issues though, however locally I’m seeing issues. As far as I can tell I’ve followed the example projects essentially verbatim so I’m not sure what I could be doing wrong.
The log is showing 16 files being analyzed but even things like lines of code don’t seem properly reported.
Some code smells in the first file, cpptrace.cpp, that are detected locally but not here:
165: Refactor this function to reduce its Cognitive Complexity from 37 to the 25 allowed. [+17 locations]sonarlint(cpp:S3776)
182: Extract the assignment from this expression.sonarlint(cpp:S1121)
316: Global variables should be const.sonarlint(cpp:S5421)
317: Global variables should be const.sonarlint(cpp:S5421)
The logs you are sharing don’t look suspicious to me. I am going to focus on the expected but missing S3776 report on cpptrace.cpp in my analysis below. I took note of the following, please let me know if any of my conclusions sound incorrect to you:
The issue report exists on SC, but is now marked as fixed. This usually means that the issue was detected in one analysis and a subsequent analysis didn’t report the issue. This normally happens when the code is fixed, but could also be the case when the rule is turned off, or the file is excluded from analysis.
The logs you shared have INFO: Quality profile for cpp: Sonar way: You are using the default Sonar way, which means that S3776 is not disabled.
INFO: 29 files indexed along with INFO: [pool-5-thread-1] /home/runner/work/cpptrace/cpptrace/src/cpptrace.cpp prove that the file cpptrace.cpp has been analyzed in the run you are sharing.
By looking at the analyses listed under “Latest activity”, I could see that there is one analysis that ran with inclusion/exclusion patterns that don’t match any files. You can see in the logs there:
INFO: 0 files indexed
INFO: 30 files ignored because of inclusion/exclusion patterns
My guess is that this somehow broke the results on the main branch because no issues were reported for main using the mentioned configuration. This subsequently affects the detected issues on the PR.
If the above explanation seems plausible, I would suggest re-creating the whole project on SonarCloud (if you haven’t done a lot of customization there) and re-running analysis using your current PR to re-trigger main branch analysis on the fresh SonarCloud project.
Another approach, if you don’t want to re-do the customization on your SonarCloud project, I think it might be possible to fix the analysis on the project by sending a correct analysis on the main branch. This can be done easily by just merging your current PR, and letting the analysis run once on main.
Also, you mentioned at some point:
Ok, I figured out the issue of the plugin not being loaded and files not being checked. There was a configuration issue on the sonarcloud.io page.
Could you share what the configuration issue you found was? Maybe this could be a related hint? or something that we can improve on our end?
Could you share what the configuration issue you found was? Maybe this could be a related hint? or something that we can improve on our end?
I think it was due to incorrect source file inclusion/exclusion settings on sonarcloud.io that were causing files to not be indexed and analysis to not run.
Your explanation seems plausible to me. I might try merging my pr both to see if an analysis there fixes things and also to eliminate a source of problems if I recreate the project on sonarcloud.