当声纳分析绑定到多模块项目中的maven生命周期时，如何使SonarQube模块只分析项目一次?

2022-01-17 00:00:00 sonarqube java maven cobertura static-code-analysis

我想要实现的是将 SonarQube 分析集成到构建过程中，以便每当运行 mvn clean install 时，都会使用 SonarQube 分析代码.我们希望将其用于本地分析以及基于 Jenkins 的构建.如果发现新问题，那么构建应该会失败(我们想为此使用构建中断插件).这样，开发人员就会知道他的代码将引入新问题，并且必须修复它们才能使构建工作.

What I am trying to achieve is integrate SonarQube analysis into the build process, so that whenever mvn clean install is run, the code is analyzed with SonarQube. We want to use it for local analysis and also for build on Jenkins. If new issues are found, than the build should fail (we want to use build breaker plugin for that). This way the developer would know that by his code his is going to introduce new issues, and will have to fix them for the build to work.

当我运行 mvn sonar:sonar 时，分析需要 30 秒，还可以.

When I run mvn sonar:sonar, the analysis takes 30 seconds, which is OK.

但是，当我尝试将 sonar 目标绑定到 maven 构建阶段时，就会出现问题.我将 sonar 绑定到 verify 阶段.现在构建需要 5 分钟，这太长了.大约需要 1 分钟.在没有 SonarQube 分析的情况下，构建本身需要 30 秒.

However, the problem occurs when I am trying to bind sonar goal to maven build phases. I bind sonar to verify phase. The build takes 5 minutes now, which is too long. It should take about 1 minute. The build itself, without SonarQube analysis takes 30 seconds.

注意(可能有助于找出问题所在):运行构建的项目中有多个模块，我想这就是问题所在.看起来 sonar:sonar 目标被执行了多次，每个子模块执行一次，并且整个项目被多次分析(不仅仅是子模块).所以，我们有 4 个子模块，在构建过程中生成了 5 次报告.

Note (may help to figure out what the problem is): the project on which the build is run has multiple modules in it, and I guess that is the problem. It looks like sonar:sonar goal is executed multiple times, once for each submodule, and the whole project is analyzed multiple times (not only the submodules). So, we have 4 submodules, and the report is generated 5 times during the build.

相反，我们只想分析整个项目一次，而不是 5 次.在为所有模块生成 cobertura 报告之后，在构建结束时运行此 1 分析也很重要.

Instead, we want to analyze the whole project only once, not 5 times. It's also important for this 1 analysis to be run at the end of the build, after the cobertura reports are generated for all modules.

那么，如何将 SonarQube 分析集成到构建中，以便它只分析我的多模块项目一次，最后在为所有子模块生成 cobertura 报告之后?

So, how do I integrate SonarQube analysis into the build, so that it analyzes my multi-module project only once, in the end, after cobertura reports are generated for all the submodules?

父 pom 中的 SonarQube 插件属性:

<!-- Sonar plugin properties -->
<sonar.jdbc.url>jdbc:url</sonar.jdbc.url>
<sonar.analysis.mode>preview</sonar.analysis.mode>
<sonar.issuesReport.html.enable>true</sonar.issuesReport.html.enable>       
<sonar.issuesReport.console.enable>true</sonar.issuesReport.console.enable>
<sonar.host.url>sonar.host:9000</sonar.host.url>
<sonar.language>java</sonar.language>
<sonar.buildbreaker.skip>false</sonar.buildbreaker.skip>
<sonar.qualitygate>Sonar%20way%20with%20Findbugs</sonar.qualitygate>
<sonar.preview.includePlugins>buildbreaker</sonar.preview.includePlugins>
<sonar.exclusions>file:**/target/**</sonar.exclusions>
<branch>development</branch>

项目pom中的插件配置:

                <!-- Run cobertura analysis during package phase -->
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>cobertura-maven-plugin</artifactId>
                    <executions>
                        <execution>
                           <phase>package</phase>
                              <goals>
                                 <goal>cobertura</goal>
                               </goals>
                        </execution>
                  </executions>
                </plugin>

                <!-- Run sonar analysis (preview mode) during verify phase. Cobertura reports need to be generated already -->
                <plugin>
                   <groupId>org.codehaus.mojo</groupId>
                   <artifactId>sonar-maven-plugin</artifactId>
                   <version>2.5</version>
                   <executions>
                        <execution>
                           <phase>verify</phase>
                              <goals>
                                 <goal>sonar</goal>
                               </goals>
                        </execution>
                  </executions>
                </plugin>

推荐答案

IMO，这只是一个 Maven 配置问题，您缺少 <inherited>false</inherited> 元素sonar:sonar的执行:

IMO, this is just a Maven configuration issue, you're missing the <inherited>false</inherited> element on the execution of sonar:sonar:

                <!-- Run sonar analysis (preview mode) during verify phase. Cobertura reports need to be generated already -->
                <plugin>
                   <groupId>org.codehaus.mojo</groupId>
                   <artifactId>sonar-maven-plugin</artifactId>
                   <version>2.5</version>
                   <executions>
                        <execution>
                           <phase>verify</phase>
                           <goals>
                              <goal>sonar</goal>
                           </goals>
                           <inherited>false</inherited>
                        </execution>
                  </executions>
                </plugin>

相关文章