We utilize the pipeline and after the build completes successfully we are running the following:
bat "mvn sonar:sonar -B -s ${buildSettings} -Dsonar.analysis.mode=preview -Dsonar.skipDesign=true -Dsonar.report.export.path=sonar-report.json"
sonarToGerrit(severity: 'Major', postScore: true, category: 'Code-Review', newIssuesOnly: true, issuesScore: '0', noIssuesScore: '0', changedLinesOnly: true)
The below build log shows that it found a good number of issues but yet the issues to be commented is 0.
Build log
Other posts suggest that it may not be finding the report but I don't believe it's the case as it found a number of issues. Any pipeline configuration advice would be much appreciated.
We are using Sonar Gerrit plugin version 2.2.1, Gerrit Trigger 2.27.3 and Jenkins Enterprise version is 2.60.3.1.
The most common case regarding to your question is related to the fact that SonarQube checks the whole project, regardless of amount of changes that were done in particular change. When creating a new report, it compares a result with a result that is stored to it's database (with previously found issues that were found in a mode other than preview). Thus sonar marks as new all the issues that it was not aware about before (and if you don't store this information in SonarQube at all - all the issues will be marked as new). But sonar-gerrit plugin can only post issues to the files that were affected by the change it is verifying. So, even if you set to "false" the settings "newIssuesOnly" and "changedLinesOnly", all the issues in files not affected by the change will be ignored.
Shortly, check that the issues marked with "isNew"="true" in your sonar report were actually changed (for changedLinesOnly=true) or located in the changed files (for changedLinesOnly = false) in the commit you are trying to check.
Another possible reason is the project configuration settings. If your files are part of a submodule, you'll need to include the submodule name to project base directories set. Or you may want to try a feature "allow auto match" instead. The feature tries to match SonarQube modules to Gerrit names automatically (available since 2.1).
Not related to your question advises regarding your pipeline code:
At the moment settings recognition for severity (and other enum values) is case-sensitive. In fact, the plugin ignores your "Major" setting as it cannot recognize it, and replaces it with default "INFO" value.
Another thing, I don't see why do you set your "postScore" to true as you set "issuesScore" = 0 and "noIssuesScore"=0. You can just set postScore=false and skip these settings along with "category" for sake of simplicity.
Also, if you use the version of plugin above 2.0, be aware that API has slightly changed and now uses the next structure:
sonarToGerrit (
reviewConfig: [
issueFilterConfig: [
severity: 'MAJOR',
newIssuesOnly: false,
changedLinesOnly: false
],
noIssuesTitleTemplate: 'Your text here',
someIssuesTitleTemplate: 'Your text here',
issueCommentTemplate: 'Your text here'
]
)
Though your code should also work (plugin does support previous versions), there is a bigger chance that there may be a bug.
I am also facing the same issue with Sonar-Gerrit jenkins plugin. Downloaded it from Jenkins plugins site.Using Sonar-Gerrit plugin 2.2.1, and analysing sonar scan against jenkins workspace.
For a sample,have changed just one file and provided the project base directory to the path of that file, and ran the sonar analysis in issues mode.
Issues are not loaded in Gerrit with logs
Report has loaded and contains 759 issues
Issues to be commented: 0
Issues to be involved in score calculation: 0
Review has been sent
Related
I have some code that want to SonarQube not check this vulnerability while every deployment.
Any method for add rule for not check X type vulnerability with some error text ?
I found an answer and want to inform for who need answer
https://sqa.stackexchange.com/questions/24734/how-to-deactivate-a-rule-in-sonarqube
Need to copy existing SonarQube built-in profile and deactivate/add new rule in new profile,
after that go to project settings and change Quality Profile.
When Github Trigger is set to listen a tag the files filter is ignored and the trigger is set on every push
I have tried different settings on multiple triggers and nothing works
I've tried using a path like this packages/backend-node/src/* and didn't work either
I noticed something similar but found the following in the docs:
If you push a change to a newly created branch, then Cloud Build
treats all the files in the repository as changed files.
So pushing a new branch to your repo will always trigger your build and ignore the file filters.
Source: https://cloud.google.com/build/docs/automating-builds/create-manage-triggers#build_trigger (the link no longer includes the quote from above)
Open bug report in google's issue tracker: https://issuetracker.google.com/issues/217776771
I am using sleroy/SonarEsLintPlugin plugin to integrate eslint with sonarqube v6.7.2. I have these three other eslint plugins that I want to integrate into sonarqube v.6.7.2.
A. redux-saga
B. react
C. jsx-a11y
and below is my sonar-project.propeties file:
sonar.projectKey=abc
sonar.projectName=xyz
sonar.projectVersion=0.0.0.1
sonar.sources=app/
sonar.exclusions= app/utils/**/*,
sonar.language=js
sonar.javascript.file.suffixes=.js,.jsx
sonar.profile=ReactJs
sonar.eslint.eslintpath=node_modules/eslint/bin/eslint.js
sonar.eslint.eslintconfigpath=package.json
sonar.eslint.eslintrulesdir=react,redux-saga,jsx-a11y
sonar.sourceEncoding=UTF-8
sonar.login=pqr
sonar.password=jkl
These three plugins rules are specified on eslint-rules.properties file and it is showing these rules on sonarqube also.
but the problem here is that sonarqube is not generating any report related to these three rules even I have intentionally made a mistake.
can anyine please check whether I have specified "sonar.eslint.eslintrulesdir" path right or I am missing something.
Please help me with this I am into this issue since past 3 days.
I have a web app project where the quality is measured under sonarqube.
As i'm dealing with an external code within my project files
Recently i have had some issues appearing due to that exetrnal code and which i'm not focusing on its quality :
So i wanna just delete the issue to appear from my sonar dashboard (which looks like the following):
The solutions that i have had where not really usefull , as :
i was suggested to change the level of the rule itself from "issue" to "info" :
And of course that seems to be not usefful because , i won't affect the rule itself
the second suggestion was to use the :
#SuppressWarnings decorator in my blocks of code where the issues appeared ; : for example use it under classes or methods or even fields
-> this method results in adding some code to my extarnal code and that won't be also good as i'm not even having the permission to do it.
I wanna just the simpliest solution to delete the issue from the sonar dashboard , just suppress it from the SonarQube interface , strangely it seems that there is no a direct way to do it :
Any better ideas ??
The easiest way is excluding external code from the report with narrowing the focus feature.
Just add to your sonar-project.properties file path pattern to exclusion, for example
# Exclude all classes ending by "Bean"
# Matches org/sonar.api/MyBean.java, org/sonar/util/MyOtherBean.java, org/sonar/util/MyDTO.java, etc.
sonar.exclusions=**/*Bean.java,**/*DTO.java
# Exclude all classes in the "src/main/java/org/sonar" directory
# Matches src/main/java/org/sonar/MyClass.java, src/main/java/org/sonar/MyOtherClass.java
# But does not match src/main/java/org/sonar/util/MyClassUtil.java
sonar.exclusions=src/main/java/org/sonar/*
If you're not interested some issues because it's not your code, then you should not have SonarQube analyze that code. According to the SonarQube documention:
We recommend that you exclude generated code, source code from
libraries, etc.
You should check in particular the following settings in the same documentation page:
sonar.sources
sonar.exclusions
These settings will be taken into account the next time you run an analysis.
I am looking for a Sonar Property to attach the quality profile during the build. In previous versions of Sonar there was a property -Dsonar.profile which is deprecated now. Can anyone please help me to get the property to attach the quality profile at runtime.
I am using Sonar version 4.5.7. Any help is highly appreciated.
Thanks,
Sanjiv
It has been marked as deprecated with no replacement.
Quoting page http://docs.sonarqube.org/display/SONARQUBE43/Analysis+Parameters :
Note that only parameters set through the UI are stored in the
database. For example, if you override the sonar.profile parameter via
command line for a specific project, it will not be stored in the
database. Local analyses in Eclipse, for example, would still be run
against the default quality profile.
And the latest version of the same page http://docs.sonarqube.org/display/SONAR/Analysis+Parameters has link to ticket about deprecation that contains other details - https://jira.sonarsource.com/browse/SONAR-5370
In other words - profile should be configured via UI or using web services.