SonarQube 4.5.4 with Java plugin 3.5 doesn't recognize special Lombok annotations

Question

I have recently updated SonarQube to version 4.5.4 and the Java plugin to version 3.5.

We have classes annotated with @Data, but it seems that the rule squid:S1068 doesn't handle this "special" annotations. Altough they should be ignored since version 3.4 according to https://github.com/SonarSource/sonar-java/pull/257 and https://jira.sonarsource.com/browse/SONARJAVA-990.

Please see attached screenshot. Did I forget to configure something?

UPDATE:

I wanted to ensure that our used Java plugin 3.5 has included the changes of commit https://github.com/benzonico/sonar-java/commit/5e7de16f59450061227d4103f64e351d1f93d9e9 so I reverse engineered the .jar file to see the source of rule squid:S1068 UnusedPrivateFieldCheck.java. Extended Lombok releated changes are there and apparently working!

Answer 1

Finally I'm able to answer my own question with help of @benzonico's comment.

In our CI system's Sonar build log I found many warning messages: [WARN] [16:51:48.435] Class 'com/bla/bla/Application' is not accessible through the ClassLoader.

The bytecode analysis needs to get fixed for all classes and its dependencies in order to get a correct result. I had to set following Sonar properties:

sonar.java.binaries=target/classes
sonar.java.libraries=target/dependency/*.jar

Note that without sonar.java.binaries=target/classes it's not working, at least on our CI system (TeamCity).

Before running mvn sonar:sonar all Maven dependencies (transient ones too) are moved to the folder target/dependency by running mvn dependency:copy-dependencies before the analysis now.

Now the CI build log is cleaner, Lombok annotations get recognized.

Answer 2

similarly you can add to command line directly:

Steps:

CD to the path which you want to run it on, and when you run sonar-runner add the following parameters:

-Dsonar.java.binaries=target/classes -Dsonar.java.libraries=target/lib/*.jar

Note: For me it was target/lib for the jars, not target/dependency.