CODEWITHSUNDEEP
sonarqubeazure-devops
Tom Anderson
Tom Anderson

Reputation: 99

Code analysis changes if SonarQube full analysis report enabled in VSTS

I've been setting up SonarQube analysis for one of our builds in VSTS, and I've noticed that there's a difference in the code analysis / build warnings if the advanced option "include full analysis report in build summary" is enabled in VSTS.

We have a custom ruleset enabled for our local builds in Visual Studio, which combines Microsoft CodeAnalysis warnings and StyleCop analyzers. When we run the build in VSTS with the full analysis report setting enabled, these warnings don't show up, and only the SonarQube warnings are displayed. I thought this was expected for all builds using SonarQube, as mentioned here in the link below.

https://docs.sonarqube.org/display/SCAN/Analyzing+with+SonarQube+Extension+for+VSTS-TFS#AnalyzingwithSonarQubeExtensionforVSTS-TFS-Note

However, if we disable this setting, we get additional SonarQube warnings, but the Microsoft and StyleCop warnings also show up.

Can anyone explain why the two behaviors are different? Ideally, we'd like warnings from Microsoft, StyleCop and SonarQube to show up, AND for the build to include the full analysis report - is there any way to do this?

I'm using SonarQube v6.7.1.35068, SonarC# v6.7.1 (build 4347), and v3.* of the VSTS SonarQube task.

Upvotes: 1

Views: 618

Answers (2)

starian chen-MSFT
starian chen-MSFT

Reputation: 33728

First, the Include full analysis report in build summary shouldn’t affect the result in Issues section of build summary, it is used to upload the report to build summary and the result will be show in the bottom of build summary (below Work items linked to associated changes section).

enter image description here

Secondly, the Issues section of build summary can’t show all analysis result, just part of it.

You can upload the result files to build through Logging Command (e.g. Write-Host "##vso[task.addattachment type=Distributedtask.Core.Summary;name=testsummaryname;]c:\testsummary.md") and it will show in the bottom of build summary (The sonarqube task uses this way too).

Upvotes: 0

duncanp
duncanp

Reputation: 1590

The Include full analysis report in the build summary setting doesn't change the ruleset or analyzers that are run during the analysis. All it does is cause the End task to poll the SonarQube server until the server-side part of the analysis has completed so that it can show the final analysis results on the VSTS build summary page.

To work out what is different between the builds you could try enabling more verbose logging:

  • for SonarQube, set the Additional Settings property of the VSTS Begin task /d:sonar.verbose=true
  • for VSTS, set the system.debug build to true

You're right, the Begin task does limit the analyzers and rules that are run to those that are configured on the SonarQube server.

To have the Microsoft FxCop rules run as past of the analysis run you would install the FxCop plugin for SonarQube and include its rules in your Quality Profile.

To run the StyleCop rules (assuming you're using the new Roslyn-base StyleCop analyzers) you would first have to create a SonarQube plugin for it using the SonarQube Roslyn SDK, then install the plugin and add the rules to Quality Profile.

Upvotes: 0

Related Questions