search

JetBrains / TeamCity.SonarQubePlugin

A plugin for TeamCity server allowing you to configure and run SonarQube analysis from the CI
Apache License 2.0
53 stars 31 forks source link

sonar.login and sonar.password does not provided in "SonarScanner for MSBuild: finish analysis" #52

Closed gangstatracer closed 3 years ago

gangstatracer commented 6 years ago

My configuration consists of three steps:

  1. SonarScanner for MSBuild: begin analysis
  2. Perform build
  3. SonarScanner for MSBuild: finish analysis

On the first step login and password provided correctry from SonarQube server configuration, but third step is being invoked without this parameters. SonarQube documentation:

/d:sonar.login= or [optional] Specifies the username or access token to authenticate with to SonarQube. If this argument is added to the begin step, it must also be added on the end step. /d:sonar.password= - [optional] Specifies the password for the SonarQube username in the sonar.login argument. This argument is not needed if you use authentication token. If this argument is added to the begin step, it must also be added on the end step.

docs

In this way last step fails with error

ERROR: Not authorized. Analyzing this project requires to be authenticated. Please provide the values of the properties sonar.login and sonar.password.

Linfar commented 6 years ago

The problem is fixed, sorry for delay. Please update the plugin from CI page

abelal83 commented 5 years ago

I'm using sonar-scanner-msbuild.4.0.2.892 and seeing this issue, did it somehow creep back into the recent release?

Linfar commented 5 years ago

@abelal83 What TeamCity plugin version do you use?

abelal83 commented 5 years ago

Hi @Linfar I'm using sonar-scanner-msbuild.4.0.2.892, I've pasted the exact error below

[16:32:55][Step 4/9] Calling the SonarQube Scanner...
[16:32:56][Step 4/9] INFO: Scanner configuration file: C:\BuildAgent\tools\sonar-scanner-msbuild.4.0.2.892\sonar-scanner-3.0.3.778\bin\..\conf\sonar-scanner.properties
[16:32:56][Step 4/9] INFO: Project root configuration file: C:\BuildAgent\work\9cda1a4b5bf6f872\.sonarqube\out\sonar-project.properties
[16:32:56][Step 4/9] INFO: SonarQube Scanner 3.0.3.778
[16:32:56][Step 4/9] INFO: Java 1.8.0_131 Oracle Corporation (64-bit)
[16:32:56][Step 4/9] INFO: Windows Server 2012 R2 6.3 amd64
[16:32:56][Step 4/9] INFO: SONAR_SCANNER_OPTS=-Xmx1024m
[16:32:56][Step 4/9] INFO: User cache: C:\Users\SYS-APP-TEAMCITY\.sonar\cache
[16:32:56][Step 4/9] INFO: SonarQube server 7.9.0
[16:32:56][Step 4/9] INFO: Default locale: "en_GB", source code encoding: "windows-1252" (analysis is platform dependent)
[16:32:57][Step 4/9] WARNING: WARN: SonarScanner will require Java 11+ to run starting in SonarQube 8.x
[16:32:57][Step 4/9] INFO: Load global settings
[16:32:57][Step 4/9] INFO: ------------------------------------------------------------------------
[16:32:57][Step 4/9] INFO: EXECUTION FAILURE
[16:32:57][Step 4/9] INFO: ------------------------------------------------------------------------
[16:32:57][Step 4/9] INFO: Total time: 1.671s
[16:32:57][Step 4/9] INFO: Final Memory: 12M/552M
[16:32:57][Step 4/9] INFO: ------------------------------------------------------------------------
[16:32:57][Step 4/9] ERROR: Error during SonarQube Scanner execution
[16:32:57][Step 4/9] ERROR: Not authorized. Analyzing this project requires to be authenticated. Please provide the values of the properties sonar.login and sonar.password.
[16:32:57][Step 4/9] ERROR: 
[16:32:57][Step 4/9] ERROR: Re-run SonarQube Scanner using the -X switch to enable full debug logging.
[16:32:57][Step 4/9] The SonarQube Scanner did not complete successfully
[16:32:57][Step 4/9] 16:32:57.594  Post-processing failed. Exit code: 1

I have the begin analysis at the start which shows this 

[16:30:55][Step 2/9] Starting: C:\BuildAgent\tools\sonar-scanner-msbuild.4.0.2.892\MSBuild.SonarQube.Runner.exe "/d:project.home=." "/d:sonar.host.url=https://sonarqube.********.come" "/k:RoutingApi_WebApi" "/n:Routing API" "/v:1.1.469" "/d:sonar.password=*******" "/d:sonar.login=admin" begin
[16:30:55][Step 2/9] in directory: C:\BuildAgent\work\9cda1a4b5bf6f872
[16:30:55][Step 2/9] SonarQube Scanner for MSBuild 4.0.2
[16:30:55][Step 2/9] Default properties file was found at C:\BuildAgent\tools\sonar-scanner-msbuild.4.0.2.892\SonarQube.Analysis.xml
[16:30:55][Step 2/9] Loading analysis properties from C:\BuildAgent\tools\sonar-scanner-msbuild.4.0.2.892\SonarQube.Analysis.xml
[16:30:55][Step 2/9] Pre-processing started.
[16:30:55][Step 2/9] Preparing working directories...
[16:30:55][Step 2/9] 16:30:55.2  Updating build integration targets...
[16:30:55][Step 2/9] 16:30:55.239  Fetching analysis configuration settings...
[16:31:00][Step 2/9] 16:31:00.076  Provisioning analyzer assemblies for cs...
[16:31:00][Step 2/9] 16:31:00.078  Installing required Roslyn analyzers...
[16:31:03][Step 2/9] 16:31:03.067  Provisioning analyzer assemblies for vbnet...
[16:31:03][Step 2/9] 16:31:03.067  Installing required Roslyn analyzers...
[16:31:04][Step 2/9] 16:31:03.752  Pre-processing succeeded.
[16:31:04][Step 2/9] Process exited with code 0
abelal83 commented 5 years ago

Sorry @Linfar , just understood what you meant by plugin now.

We use Sonar runner 2017.1-17, if this is the buggy version could you kindly point me in the right direction on how to upgrade?

2017.1-17

Linfar commented 5 years ago

@abelal83 The latest version is 2017.1-22, you can download it from our plugin repository

abelal83 commented 5 years ago

that version worked! Thank you @Linfar

ogerovich commented 4 years ago

Hi @Linfar, It appears that this bug is back. I tried 2017.1-28 and 2017.1-30 - both have the same problem. Is 2017.1-22 the last version where this worked? Where can I get it? Could you fix the latest version?

In my case, I am using a token, so I am only specifying "/d:sonar.login=%SONAR_TOKEN%" in "SonarScanner for MSBuild: begin analysis" build step. Is this case not supported?

I tried passing "/d:sonar.password= " and "/d:sonar.password=", but that did not work.

Linfar commented 4 years ago

@ogerovich Do you specify credentials in the additional arguments? Why not in SonarQube Servers tab?

ogerovich commented 4 years ago

Yes, I specify /d:sonar.login=%SONAR_TOKEN% in additional parameters box. I use SONAR_TOKEN "password" parameter to store the token. I didn't want to use SonarQube Servers tab because putting the token in the username box shows it in plain text. However, after you asked, I realized that using %SONAR_TOKEN% there works! So I have a good enough workaround. If you only added support for auto-complete/build parameter icon to those fields, it would be more apparent, but I don't know if that's possible...

Without the workaround, I think the logic for "MSBuild: end analysis" should match the rules on https://docs.sonarqube.org/latest/analysis/scan/sonarscanner-for-msbuild/:

/d:sonar.login=<username> or <token> | [optional] Specifies the username or access token to authenticate with to SonarQube. If this argument is added to the begin step, it must also be added on the end step.
-- | --
/d:sonar.password=<password> | [optional] Specifies the password for the SonarQube username in the sonar.login argument. This argument is not needed if you use authentication token. If this argument is added to the begin step, it must also be added on the end step.

Since it says "This argument is not needed if you use authentication token." and the token is passed via /d:sonar.login, "MSBuild: end analysis" should not pass /d:sonar.password. Is it being passed in all situations?

Linfar commented 4 years ago

Ok, yes, token should be hidden, haven't thought about it. Using a parameter is indeed a good workaround here.

Password shouldn't be passed to the cmd if it's empty. Tell me if it is.

ogerovich commented 4 years ago

When I use the workaround with %SONAR_TOKEN% on SonarQube Servers tab and empty password, it only passes the login in begin and end steps and everything works fine:

[14:12:57]  [Step 4/6] Starting: C:\TeamCity\buildAgent\tools\sonar-scanner-msbuild.4.0.2.892\MSBuild.SonarQube.Runner.exe "/d:sonar.login=*******" end

When I have no credentials on SonarQube Servers and specify /d:sonar.login=%SONAR_TOKEN% in additional parameters box of the "MSBuild: begin analysis" step, the end step passes nothing and fails:

[07:51:22]  Step 4/6: SonarScanner for MSBuild: finish analysis (3s)
[07:51:22]  [Step 4/6] Starting: C:\TeamCity\buildAgent\tools\sonar-scanner-msbuild.4.0.2.892\MSBuild.SonarQube.Runner.exe end
[07:51:22]  [Step 4/6] in directory: C:\TeamCity\buildAgent\work\3db0c757f5d812a8
[07:51:22]  [Step 4/6] SonarQube Scanner for MSBuild 4.0.2
[07:51:22]  [Step 4/6] Default properties file was found at C:\TeamCity\buildAgent\tools\sonar-scanner-msbuild.4.0.2.892\SonarQube.Analysis.xml
[07:51:22]  [Step 4/6] Loading analysis properties from C:\TeamCity\buildAgent\tools\sonar-scanner-msbuild.4.0.2.892\SonarQube.Analysis.xml
[07:51:22]  [Step 4/6] Post-processing started.
[07:51:24]  [Step 4/6] SONAR_SCANNER_OPTS is not configured. Setting it to the default value of -Xmx1024m
[07:51:24]  [Step 4/6] Calling the SonarQube Scanner...
[07:51:24]  [Step 4/6] INFO: Scanner configuration file: C:\TeamCity\buildAgent\tools\sonar-scanner-msbuild.4.0.2.892\sonar-scanner-3.0.3.778\bin\..\conf\sonar-scanner.properties
[07:51:24]  [Step 4/6] INFO: Project root configuration file: C:\TeamCity\buildAgent\work\3db0c757f5d812a8\.sonarqube\out\sonar-project.properties
[07:51:24]  [Step 4/6] INFO: SonarQube Scanner 3.0.3.778
[07:51:24]  [Step 4/6] INFO: Java 1.8.0_45 Oracle Corporation (64-bit)
[07:51:24]  [Step 4/6] INFO: Windows 8.1 6.3 amd64
[07:51:24]  [Step 4/6] INFO: SONAR_SCANNER_OPTS=-Xmx1024m
[07:51:24]  [Step 4/6] INFO: User cache: C:\Users\o_gerovich\.sonar\cache
[07:51:25]  [Step 4/6] INFO: SonarQube server 7.7.0
[07:51:25]  [Step 4/6] INFO: Default locale: "en_US", source code encoding: "windows-1252" (analysis is platform dependent)
[07:51:25]  [Step 4/6] INFO: Load global settings
[07:51:25]  [Step 4/6] INFO: ------------------------------------------------------------------------
[07:51:25]  [Step 4/6] INFO: EXECUTION FAILURE
[07:51:25]  [Step 4/6] INFO: ------------------------------------------------------------------------
[07:51:25]  [Step 4/6] INFO: Total time: 0.602s
[07:51:25]  [Step 4/6] INFO: Final Memory: 12M/491M
[07:51:25]  [Step 4/6] INFO: ------------------------------------------------------------------------
[07:51:25]  [Step 4/6] ERROR: Error during SonarQube Scanner execution
[07:51:25]  [Step 4/6] ERROR: Not authorized. Analyzing this project requires to be authenticated. Please provide the values of the properties sonar.login and sonar.password.
[07:51:25]  [Step 4/6] ERROR: 
[07:51:25]  [Step 4/6] ERROR: Re-run SonarQube Scanner using the -X switch to enable full debug logging.
[07:51:25]  [Step 4/6] The SonarQube Scanner did not complete successfully
[07:51:25]  [Step 4/6] 07:51:25.347  Creating a summary markdown file...
[07:51:25]  [Step 4/6] 07:51:25.352  Post-processing failed. Exit code: 1
[07:51:25]  [Step 4/6] Process exited with code 1
[07:51:25]  [Step 4/6] Process exited with code 1 (Step: SonarScanner for MSBuild: finish analysis)
[07:51:25]  [Step 4/6] Step SonarScanner for MSBuild: finish analysis failed
[07:51:25]  [Step 4/6] Error message is logged

It seems like the end step should check if the begin step passed login and/or password and pass matching values.

Linfar commented 4 years ago

Ok, yes, token should be hidden, haven't thought about it. Using a parameter is indeed a good workaround here.

Password shouldn't be passed to the cmd if it's empty. Tell me if it is.

sud007 commented 1 year ago

Yes, I specify /d:sonar.login=%SONAR_TOKEN% in additional parameters box. I use SONAR_TOKEN "password" parameter to store the token. I didn't want to use SonarQube Servers tab because putting the token in the username box shows it in plain text. However, after you asked, I realized that using %SONAR_TOKEN% there works! So I have a good enough workaround. If you only added support for auto-complete/build parameter icon to those fields, it would be more apparent, but I don't know if that's possible...

Without the workaround, I think the logic for "MSBuild: end analysis" should match the rules on https://docs.sonarqube.org/latest/analysis/scan/sonarscanner-for-msbuild/:

/d:sonar.login=<username> or <token> | [optional] Specifies the username or access token to authenticate with to SonarQube. If this argument is added to the begin step, it must also be added on the end step.
-- | --
/d:sonar.password=<password> | [optional] Specifies the password for the SonarQube username in the sonar.login argument. This argument is not needed if you use authentication token. If this argument is added to the begin step, it must also be added on the end step.

Since it says "This argument is not needed if you use authentication token." and the token is passed via /d:sonar.login, "MSBuild: end analysis" should not pass /d:sonar.password. Is it being passed in all situations?

This happens for me as well. I think on the same lines as reply above that once PAT token has been passed in the sonar.login it should not consider the sonar.password. Not sure why that is happening, even on Sonar Local.