Run SonarScanner analysis with Java 11, run target code with Java 8

Question

As the following announcement points out, SonarSource ended support to run code Analyzers with pre-11 Java versions:

January 2021 - Move analysis to Java 11

The version of Java installed in the scanner environment must be upgraded to at least Java 11 before 1 February 2021. Pre-11 versions of Java are already deprecated and scanners using them will stop functioning on that date.

Additionally, there will be a brownout from 11 January 2021 to 15 January 2021 during which the first analysis run with a scanner using Java versions less than 11 will fail. To avoid this inconvenience you should upgrade by 11 January 2021.

The installation of Java discussed here refers specifically to the JDK or JRE installed and used in the context where your SonarCloud scanner analysis tool is running. This may be your local build environment or your Cl service.

This does not have any impact on the Java version targeted by your project code. You can still analyze Java projects that target versions less than 11.

I have tried to search for a full example about how to run a bitbucket pipeline to execute SonarScanner analysis using a java 11 Analyzer but having target code using pre-java 11 versions (e.g. java 8), but I wasn't able to found one. According to that image, it should be possible.

Answer 1

I'm not sure what is the problem. The announcements informs that you have to use Java 11+ to execute scans, but you can still compile your code with Java <11. You didn't provide any information about your project, so let's take a Maven project as an example.

It generally means that you have to do something like this:

// set Java to 8
export JAVA_HOME=/path/to/jdk8/

// compile, test and build
mvn package

// set Java to 11
export JAVA_HOME=/path/to/jdk11/

// execute scanner
mvn sonar:sonar

Answer 2

While @agabrys offers the most straightforward solution and the one we use, albeit via Jenkins freestyle job, invoke maven top-level target package, then end-inject JAVA_HOME variable and invoke maven sonar step, an alternative approach is ...

Use Java 11 throughout, but in your maven pom, specify:

<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>

This is a minor risk of runtime incompatibility as noted at the bottom of that page.

Another alternative is to use profiles in conjunction with maven toolchains, tied to different profiles, one for the compilation and one for the analysis steps.