Scanning multi-language projects with SonarQube

Question

I'm trying to implement SonarQube (SonarCloud) to our development pipeline. We are using TFS (on-premise) and our project has just one repository. In this repository, we have two different applications, one .NET application, and one javascript application.

The folder structure is like this:

|
|- NetProjectFolder
|- JSProjectFolder

And our build definition (which is working with Pull Requests) steps are like this:

1. SonarQube Scanner for MSBuild - Begin Analysis (for .NET project)
2. Visual Studio Build (build .NET project solution)
3. Visual Studio Test (tests of the .NET solution)
4. SonarQube Scanner CLI (To scan JS project)
5. SonarQuber Scanner for MSBuild - End Analysis

I was thinking that step 4 and step 5 will analyze our .NET and JS projects and at the end, I will see a full report of our all projects. But, when step 4 completed it's automatically uploading the report of JS project and when step 5 completed it's overwriting JS report, uploading the report of .NET project.

In the end, there are only .NET project's report/warning / technical debt etc. Because step 5 overwriting step 4's result.

How can I configure these steps so SOnarQube can analyze both our JS and .NET projects properly?

Answer 1

At the time of writing, the behavior you are seeing is "by design", even though it is not very intuitive. In other words, you cannot chain Scanner for MSBuild and Scanner CLI.

Scanner for MSBuild is able to scan JavaScript code (and all other languages too) only if it is referenced from a project in the currently analyzed solution. For example, if your WebApplication project contains JS (or TS, Java, COBOL, etc.) files they will be analyzed.

When the non-.NET language files are not referenced in the currently analyzed solution, it is better to create a separate SonarQube project to store the analysis results from Scanner CLI.

We are aware of this limitation and we are planning to fix it in the near future, but right now I cannot commit to a specific date.