sonarqube-10/25.2.0.102705 package update

[octo-sts]

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

• Detected Error: "Hunk #1 FAILED at 12. 1 out of 1 hunk FAILED -- saving rejects to file gradle.properties.rej"

• Error Category: Configuration/Patch

• Failure Point: The patch step failed when trying to apply elastic-search-server.patch to gradle.properties

• Root Cause Analysis: The patch is failing because the target file (gradle.properties) has likely changed in the newer version of SonarQube, causing the patch lines to no longer match the context

• Suggested Fix:

1. Update the elastic-search-server.patch file to match the new file content:
   • Get the current gradle.properties content:

     cat gradle.properties

   • Create a new patch with proper context:

     diff -u gradle.properties.orig gradle.properties > elastic-search-server.patch

2. Alternatively, modify the property directly in the build step:

   - name: build
     runs: |
       sed -i 's/elasticsearchVersion=.*/elasticsearchVersion=7.17.15/' gradle.properties
       ./gradlew build -x test -DbuildNumber=${{vars.build-number}}

• Explanation: Patch failures typically occur when the source file has changed significantly from when the patch was created. The fix either updates the patch file to match the new file structure or directly modifies the required property during build.

• Additional Notes:

• SonarQube regularly updates its Elasticsearch dependency versions
• The patch might need regular maintenance as SonarQube versions change
• Consider using sed/awk commands in the build step for more resilient property modifications

• References:

• SonarQube Elasticsearch Compatibility Matrix: https://docs.sonarqube.org/latest/requirements/prerequisites-and-overview/
• Git Patch Documentation: https://git-scm.com/docs/git-apply

[stevebeattie]

For the failed malcontent scan, the sonarqube plugin jar files (sonar-csharp-plugin-10.6.0.109712.jar and sonar-vbnet-plugin-10.6.0.109712.jar) do indeed contain emmbedded zip files that contain sonarqube dlls. Malcontent has false positive markings for these, but I'm not sure why the aren't getting surfaced here.

Marked as reviewed so shouldn't block merging.