javasonarqubelomboksonarqube-4.5

SonarQube 4.5.4 with Java plugin 3.5 doesn't recognize special Lombok annotations


I have recently updated SonarQube to version 4.5.4 and the Java plugin to version 3.5.

We have classes annotated with @Data, but it seems that the rule squid:S1068 doesn't handle this "special" annotations. Altough they should be ignored since version 3.4 according to https://github.com/SonarSource/sonar-java/pull/257 and https://jira.sonarsource.com/browse/SONARJAVA-990.

Please see attached screenshot. Did I forget to configure something?

enter image description here

UPDATE:

I wanted to ensure that our used Java plugin 3.5 has included the changes of commit https://github.com/benzonico/sonar-java/commit/5e7de16f59450061227d4103f64e351d1f93d9e9 so I reverse engineered the .jar file to see the source of rule squid:S1068 UnusedPrivateFieldCheck.java. Extended Lombok releated changes are there and apparently working!


Solution

  • Finally I'm able to answer my own question with help of @benzonico's comment.

    In our CI system's Sonar build log I found many warning messages: [WARN] [16:51:48.435] Class 'com/bla/bla/Application' is not accessible through the ClassLoader.

    The bytecode analysis needs to get fixed for all classes and its dependencies in order to get a correct result. I had to set following Sonar properties:

    sonar.java.binaries=target/classes
    sonar.java.libraries=target/dependency/*.jar
    

    Note that without sonar.java.binaries=target/classes it's not working, at least on our CI system (TeamCity).

    Before running mvn sonar:sonar all Maven dependencies (transient ones too) are moved to the folder target/dependency by running mvn dependency:copy-dependencies before the analysis now.

    Now the CI build log is cleaner, Lombok annotations get recognized.