How to keep false positives in sonar between branches? - sonarqube

Is it possible in sonar to transfer "false positives" between branches?
This is our workflow: we develop in branch 1, we do our sonar checks on this branch, when branch 1 will be released, we merge this into the trunk, then we create branch 2 from the trunk, and we do our sonar checks on branches2.
This "branch 2" is a new sonar project (it can't be the same because we sometimes have 2 branches open at the same time and also 2 sonar projects). But this "branch 2" sonar project has lost all the "false positives" marks.
How can we keep the false positives between 2 branches?

No, this is not possible yet. You can ask for this feature and discuss it on the Sonar user mailing-list.

There is a plugin that can be used for this https://github.com/willemsrb/sonar-issueresolver-plugin (also available in update center)
Basically you export the resolutions from one branch into another one. This can be automated using your CI system since the plugin provides REST api.
Update issues from another project: http POST to /api/issueresolver/update
Export issues from a project: http GET to /api/issueresolver/export
Import issues in a project: http POST to /api/issueresolver/import

Related

Sonarqube Branch does not exist on server

When I try to analyze my project using sonar-scanner, the scan fails with the following error message:
Caused by: Branch does not exist on server: develop
Apparently, this only happens when it analyzes a Pull Request from GitHub. I could reproduce the error, when I add the following configuration to sonar-project.properties:
sonar.branch.name = source-branch
sonar.branch.target = target-branch
What could be the cause for this problem?
I solved the problem by deleting my Sonar project that was watching the develop branch. Then I added the develop branch as a long-living branch to the Sonar project analyzing the master branch. Before, I had a Sonar project for each long-living branch, because I was using the branches property in travis.yml (which is getting deprecated now).
To add a new branch to Sonarqube you need to add the sonar.branch.name property with the name of the desired branch to the sonar-project.properties file. E.g.: sonar.branch.name=develop
Then you run sonar-scanner and your branch will be available inside the Sonar-Project.*
* Make sure to check if the Regex for long-living branches is appropriate to your new branch on Sonarqube. You can't change a long-living branch to a short-living branch or vice-versa after the branch is added to Sonarqube.
The result is that I have only one project on Sonarqube now that watches all my branches. It's a lot cleaner and works better.
More information on the branch plugin.

TeamCity best practice setup for multiple branches

I'm looking for advice on the best approach to setup TeamCity/Octopus.
Currently I have multiple branches in TFS2015 - dev, main and release (currently we create a release branch for each release).
Our procedure is to develop in dev and deploy to dev environment. When we are ready for testing we merge from dev to main and deploy to test from main. When happy we create a release branch and deploy to live from the release branch. This is a manual process.
Hotfixes are done on the release branch and deployed to live. We then merge back to main/dev.
I'm totally new to this and so far in a VM playground I've setup TFS2015, TeamCity and Octopus and can check-in to TFS, build/create package on TeamCity and deploy this pack from Octopus. But...
I'm unsure how I should setup TeamCity and Octopus to work with multiple branches? Multiple projects for each branch and generate different artifacts?
When I do this for real I have a TFS VM, I plan on installing TeamCity and Octopus on this along with the build agent. Is this a bad idea? Should I create a new VM just for TM and Octopus?
Any advice or best practice would be appreciated.
Although your question is good in scope, but a good answer must cover many details to be complete.
Let me try to point out the main areas that you will need to further investigate and configure.
TeamCity
A VCS root can be configured to listen to multiple branches via a branch specification
A VCS root can contain multiple projects/solutions and these can be built in multiple steps within TeamCity.
Given that Team City does not support conditional build steps, you will need a different strategy to allow you to vary build steps (and parameters) per release channels / environments.
My recommend approach is to split up the builds into a build definition per release channel (target environment).
Dev and Feature branches could share a single build definition.
Master and Hotfix branches can share a single build definition since they both publish to staging/production environments.
Release branches will need a separate build definition and publish to QA/Testing environment.
This gives you fine grained control over parameter and configurations of each release channel. build a debug version of your app from Dev branch for example at major version 3, while build a release version from Master branch with major version 2.
Every build definition will have a step to publish its artefacts/packages to Octopus Deploy, and specify the channel of which the artifacts belong to.
Octopus Deploy
In Octopus Deploy, define the channels to reflect the release channels, that also reflect your branching model.
Develop, Test, Release are my standard goto channels
Each channel can enforce a different Lifecycle to limit the environments that a channel can deploy to and how an application progresses through your overall ALM cycle.
I know this is not a complete answer. but it is a good start that I hope can help you refine your question to more specific technical details.
We're having somewhat similar CI setup requirements except TFS. In our case workflow for most projects is: GitHub -> TeamCity -> Octopus Deploy.
So I'm not sure about multi-branch setup with TFS, but in case with GitHub repos it's pretty easy to configure in TeamCity. You just have to specify branch-related settings in your VCS root (see Branch configuration). When you have configured that, TeamCity will let you run build's for every specified branch separately and will display build statuses for every branch nicely.
In Octopus we use Channels feature to split workflows of releases coming from different branches. That means we have channel-per-branch convention for the projects, so that TeamCity is pushing packaged releases from particular branch (in our case it's develop and master) into it's respective channel in Octopus (see Channels in Octopus).
Probably you can setup all the services on single machine but imho it's not the best practice to do performance-wise and scalability-wise.
Off course I don't know you code etc but I think you should step away from merging from dev to test and then creating a version from test. That way you essentially are building a different application compared to the one you were having on dev. Once you merge from test to production and build your application from there, you are releasing a build you haven't been testing.
You should strive for a flow in which you build once and deploy multiple times. So, build one package which you promote from dev to test to production.
Off course you can have a production branch on which you could fix bugs etc. The Channels feature in Octopus works great for scenario's like that.
So answering my own question (sorry), the approach I ended up taking was to simplify my branches and configure TeamCity/Octopus like so...
Branching Strategy
I've moved from
--dev
--main
--release
----release1
----release2
to
--master
--release
----release1
----release2
Master is where most of the devs do their work, when we are ready for a release we have a cut-off point and merge master into a new release branch.
The release branch is deployed to test and any fixes from testing are made on the release branch.
When testing is complete we deploy to live/production from this branch.
This means that the binaries we have tested are exactly the same as the ones we deploy to live/production.
Teamcity
In TeamCity master is automatically built each time a check-in occurs. Then the package is pushed to Octopus. Octopus acts as a repository in this case. TeamCity also creates the release on Octopus. So it should be checkin->build->create release->deploy.
To do this, I have one VCS Root and have a build configuration called Build-Master. This uses the checkout rules to ensure I'm only using the master branch. I use the Ocotpus packaging to build the package then use the OctopusDeploy runner in TeamCity to create a release automatically and deploy to the dev servers.
Release is different. I want to deploy to the test servers manually rather than each time a check-in occurs. When happy promote this to the live production servers.
Any fixes from test will be made to the release branch and deployed to test.
When testing is complete we promote to live and any hotfixes are made on the release branch. Obviously all fixes/hotfixes are merged down to master.
So, in TeamCity to achieve this I have a build configuration called Build-Release. Again, I use the checkout rules to ensure I'm dealing with the correct release branch.
The build creates a package using OctoPack, however this time it's not pushed to Octopus.
Octopus
Octopus has a project specifically for deploying master to our dev servers, for example projectnamehere-dev.
In Octopus, I have a separate project for Test/Prod. I've setup an external feed which points at TeamCity so I can pickup the package created in TeamCity. This is setup in Library->External Feeds.
So, to deploy to test. I create the release branch in TFS and give it a version number, 1,2,3 etc. I then change the Build-Release build config to point at this new branch. Change the version number.
Then in Octopus, I create a release, select this package and deploy to test. Any fixes from testing are made on this release branch. I just build the package again and create a new release and choose the new package.
When testing is complete, in Octopus I just promote the last release to the live production servers.
Channels in Octopus are used on the two projects because they have different life cycles. I also created two new life cycles, the default is dev/test/prod. I created just a dev and then test/prod.
Hope this helps.
In the version control settings -> vcs -> Branch Specifications: "*" ("This will do all branch, filter as needs be" e.g. +:refs/heads/master +:refs/heads/develop)
enter image description here
Octopus doesn't handle branches, it only deploys, you can however use their rest api, so for example, if test pass in develop then call the octopus rest api to create a new release and deploy.

Project analysis (Sonar Report )for branches

I recently configured our build server using bamboo and Sonar. In our case we have a multiple developer environment and chose to not only analyse our trunk but also the branch. The nightly builds of trunk and branch are analysed by sonar. And there lies our problem. The last build will be the build saved in Sonar, which is plausible from a Sonar point-of-view, ie the projects have the same name so are probably the same.
In Branch we have fixes for our major release all projects name and code are same just in branch we have bug fixes. so we would love to see the analysis of branch and trunk separately in sonar dashboard.
The question is there is a way to make multiple version of the same project in Sonar? Or is there any other best practice in this situations?
Looking forward to you replies :)
Use the sonar.branch analysis property to distinguish the branches from head and from each other. Note that there are limitations. E.G. Issues marked "False Positive" in one version of the project will not show up as FP's in the other versions.
More analysis params in the docs

Sonarqube 5.1 TFS sonar msbuild runner with branches

We have just started using Sonarqube 5.1 integrated in TFS build as described on this page http://www.sonarqube.org/announcing-sonarqube-integration-with-msbuild-and-team-build/
We have one main branch, and two development branches for the same project.
What is the recommended strategy for handling this?
I want to be able to see analyze result trends over time and also let people working in different branches able to see analyze result for the branch they are working in. As far as I can see the Sonar msbuild runner (https://github.com/SonarSource/sonar-msbuild-runner) only supports projectkey, projectname and version, but not branch key.
Any advice and suggestions will be greatly appreciated!
Indeed Wangen, I do confirm that the MSBuild Runner 0.9 doesn't yet provide a way to inject some SonarQube properties and so including the "sonar.branch" property. This limitation is going to be dropped in version 1.0 of the MSBuild Runner. Nevertheless, you must be aware that the support of branches by SonarQube is really limited because at the end in your case you're going to have 3 different projects in SonarQube and for instance flagging an issue as false-positive won't lead to flag the same issue in another branch as false-positive.

How do I manage inter-branch dependencies in Perforce?

We are using Perforce and Maven and we are in a situation where we have one branch A that hosts a mature project and another branch B, that we are starting to dev on that uses the code hosted in the first branch.
I anticipate that going forward, there could be cases where a check-in into Branch A will result in failed compilation in Branch B because the developers working on them are not aware of specific usages and cross-dependencies. And then devs will waste time updating B code and figure that its not compiling.
Branch/project A needs to remain as its own separate entity because it's code could be used in another future project.
Can someone advice me around handling and alleviating such problem? Any best-practices that you guys can suggest? Much appreciated.
You need to set up a build environment:
1) Set up a continuous integration (CI) server, such as Jenkins. When a developer commits to Branch A, it should detect the commit and trigger a build.
2) When Branch A completes its build, it deploys its artifacts to a shared repository. Highly recommended (buy not strictly necessary) is that the build for Branch A deploys to a Repository Server, such as Nexus (but a repository in source control or a FTP server does the job too).
3) Set up Branch B in your CI server, but with a build "trigger" that runs whenever a build for Branch A succeeds.
4) Configure both build configurations to email relevant team members (or everybody?) whenever a build fails.
Also, both branches should depend on your repository from #2 above. If you need the entire environment to be repeatable and self-contained, go the repository-in-scm route.

Resources