search

mc1arke / sonarqube-community-branch-plugin

A plugin that allows branch analysis and pull request decoration in the Community version of Sonarqube
GNU Lesser General Public License v3.0
2.26k stars 526 forks source link

Add checkrun to last commit in PR instead of merge commit #937

Closed florianmutter closed 3 months ago

florianmutter commented 4 months ago

When a pull_request event is triggered the default commit that is checked out by actions/checkout is a ephemeral commit where github merged the branch of the pull request into the base branch. When running the sonar scanner on this git state the check run result is attached to this commit. This commit is no where visible in the github ui (or at least I could not find it). The check run does also not show up in the list of checks for a PR.

To Reproduce Steps to reproduce the behavior: Run sonar-scanner in a github action with pull_request trigger.

Expected behavior Check should be in list of pull request checkls

Screenshots If applicable, add screenshots to help explain your problem.

Software Versions

See also https://community.sonarsource.com/t/last-analysis-is-from-a-commit-that-doesnt-exists-on-the-repository/119566

florianmutter commented 4 months ago

Seem like setting sonar.scm.revision=${{github.event.pull_request.head.sha}} does fix this. Not sure if this breaks something else.

mc1arke commented 3 months ago

This is working as expected: Sonarqube uses the Git metadata to work out what is being scanned, and doesn't know what in that metadata is actually in remote or not. If your build-script is doing something to alter Git (e.g. merging to branches) then you need to tell Sonarqube about that by telling if what commit you want it to report against. The only impact this would have would be in reporting of issues against an invalid line if there were unexpected changes being made in the merge process.