SonarQube + Lombok configuration

Question

I am starting a new project and I need to use SonarQube , and I want to use Lombok , I have already configured it in Eclipse, and everything works fine, except for static analysis.

• Unusual private fields: when I have the @Data class, all fields are displayed as Unused private field .
• @Getter(lazy=true) : When I use this annotation, I get Redundant nullcheck of value known to be non-null see @Getter (lazy = true) (this is due to compiled code).

I think a possible solution is to delombok project to compile and run Sonar.

Similar problems in SonarQube Jira :

• [CodeGen - Lombok] false warning hint (unused private field)
• Provide a new java rule for checking an unused private field and which will support bytecode generation (cd Lombok)
• CodeGen False Warning Tooltip - Lombok

( @SuppressWarnings("PMD.UnusedPrivateField") solution @SuppressWarnings("PMD.UnusedPrivateField") does not work with the latest SonarQube 4.2 )

How can I solve this problem?

Answer 1

As a workaround, I now allow sonar to parse the code generated by delombok.

I think this is also not an ideal solution, because I analyze the generated code instead of the code that is actually written by the developer. I find this a better solution than using @SuppressWarnings, //NOSONAR or turning off rules in Sonar itself.

Below is an example to achieve this in Maven. Add this to your pom.xml:

 <properties> ... <!-- This is exposed as a workaround to do the sonar analysis in combination with delombok --> <src.dir>src/main/java</src.dir> ... </properties> ... <plugins> ... <plugin> <groupId>org.projectlombok</groupId> <artifactId>lombok-maven-plugin</artifactId> <version>${lombok-plugin.version}</version> <executions> <execution> <phase>verify</phase> <goals> <goal>delombok</goal> </goals> <configuration> <addOutputDirectory>false</addOutputDirectory> <sourceDirectory>src/main/java</sourceDirectory> </configuration> </execution> </executions> </plugin> ... </plugins> ... <profiles> ... <profile> <!-- we have to use this profile to analyse code with sonar until https://jira.codehaus.org/browse/MSONAR-70 is fixed ! --> <id>sonar</id> <properties> <src.dir>target/generated-sources/delombok</src.dir> </properties> <build> <plugins> <plugin> <groupId>org.projectlombok</groupId> <artifactId>lombok-maven-plugin</artifactId> <version>${lombok-plugin.version}</version> <executions> <execution> <phase>verify</phase> <goals> <goal>delombok</goal> </goals> <configuration> <addOutputDirectory>true</addOutputDirectory> <sourceDirectory>src/main/java</sourceDirectory> </configuration> </execution> </executions> </plugin> <plugin> <groupId>org.codehaus.mojo</groupId> <artifactId>sonar-maven-plugin</artifactId> <version>2.2</version> </plugin> </plugins> </build> </profile> ... </profiles> 

Answer 2

I am adding a pull request to support more annotation from Lombok .
For binary code, please visit here:

• Sonar Quebe 4.5.X (or supplied by sonar-java-plugin-2.4.jar)
• Sonar Quebe 5.0.X (or comes sonar-java-plugin-2.8.jar)

Answer 3

I asked a similar question a while ago: sonarqube 4.2 and lombok

Basically, you can no longer do this with annotations (e.g. @SuppressWarnings) in your code. Instead, you need to configure a rule exception (global) in SonarQube:

Click Settings → Exceptions → Problems and adding entries in the “Ignore problems in multiple criteria” section and enter something like:

 Rule Key Pattern File Path Pattern squid:S1068 **/models/**/*.java 

This makes your source code a little cleaner (since you no longer need @SuppressWarnings), but I don't like the idea of ​​setting global rules, as this can cause other problems.

---

Update:

For the "excess nullcheck value known as non-null", you can add something like the following:

 Rule Key Pattern File Path Pattern findbugs:RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE **/xxxxx.java 

And one more that may (or may be) useful to you:

 Rule Key Pattern File Path Pattern common-java:InsufficientBranchCoverage **/models/**/*.java 

Answer 4

for projects with several modules, based on what is mentioned in the findd answer, I had to add the property below in my sonar profile to avoid duplication of violations (Sonar analyzed both src / main / java and target / generated sources / delombok)

 <properties> <!-- Sonar will analyze the delombokized version of the code --> <sonar.exclusions>src/main/java/**/*</sonar.exclusions> </properties>