Search code examples
mavensonarqubeowaspsonarqube5.1

sonar-maven-plugin with multi-module maven

I have a multi-module maven project which seems to have correctly generated OWASP dependency reports at both the parent and child module /target dirs using the org.owasp:dependency-check-maven plugin as so:

dependency-check-report generation

However, referencing the plugin docs, and executing the sonar-maven-plugin as below, I just can't work out what the correct command should be, any combination seems to lead to a build failure:

mvn sonar:sonar -Dsonar.sources=? -Dsonar.dependencyCheck.reportPath=?

Can anyone explain how to configure a multi-module maven project and have Sonar recognise the OWASP dependency reports?

Below is a screenshot of the starting point - we've had a CI pipeline up and running producing separate unit and integration test coverage stats for each of the submodules for some time.

current sonar view

Solution

  • Ok, so have contacted the author and the dependency-check-sonar-plugin doesn't work with a multi-module maven project.

    So we are just going to produce a static artefact in a one-off fashion and not attempt to integrate with our CI pipeline.