Build 973 success
sonar on main · 03620cf7bd · queued 2026-09-06 22:25 UTC · finished 2026-09-06 22:26 UTC · ran 38s
setup
$ git clone ssh://git@127.0.0.1/krz/gitbay.git (03620cf7bd)
step 1/1 set -eu
installing sonar-scanner 8.1.0.6389
00:25:36.734 INFO Scanner configuration file: /var/lib/gitbay-runner/work/home/.sonar/sonar-scanner-8.1.0.6389-linux-x64/conf/sonar-scanner.properties
00:25:36.737 INFO Project root configuration file: /var/lib/gitbay-runner/work/build-1078/sonar-project.properties
00:25:36.748 INFO SonarScanner CLI 8.1.0.6389
00:25:36.753 INFO Linux 6.12.105+deb13-amd64 amd64
00:25:39.783 INFO Communicating with SonarQube Cloud
00:25:39.783 INFO JRE provisioning: os[linux], arch[x86_64]
00:25:40.611 INFO Starting SonarScanner Engine...
00:25:40.612 INFO Java 21.0.11 Eclipse Adoptium (64-bit)
00:25:43.851 INFO Load global settings
00:25:44.225 INFO Load global settings (done) | time=368ms
00:25:44.305 INFO Server id: 1BD809FA-AWHW8ct9-T_TB3XqouNu
00:25:44.458 INFO Loading required plugins
00:25:44.459 INFO Load plugins index
00:25:44.532 INFO Load plugins index (done) | time=73ms
00:25:44.534 INFO Load/download plugins
00:25:44.580 INFO Load/download plugins (done) | time=47ms
00:25:44.713 INFO Loaded core extensions: sca, a3s, architecture
00:25:45.181 INFO Process project properties
00:25:45.202 INFO Project key: krz_gitbay
00:25:45.203 INFO Base dir: /var/lib/gitbay-runner/work/build-1078
00:25:45.203 INFO Working dir: /var/lib/gitbay-runner/work/build-1078/.scannerwork
00:25:45.207 INFO Load project settings for component key: 'krz_gitbay'
00:25:45.441 INFO Load project settings for component key: 'krz_gitbay' (done) | time=233ms
00:25:45.456 INFO Check ALM binding of project 'krz_gitbay'
00:25:45.620 INFO Detected project binding: NOT_BOUND
00:25:45.621 INFO Check ALM binding of project 'krz_gitbay' (done) | time=163ms
00:25:45.623 INFO Load branch configuration
00:25:45.624 INFO Load branch configuration (done) | time=1ms
00:25:45.627 INFO Create analysis
00:25:45.899 INFO Create analysis (done) | time=272ms
00:25:46.107 INFO Load quality profiles
00:25:46.473 INFO Load quality profiles (done) | time=364ms
00:25:46.583 INFO Load active rules
00:25:46.993 INFO Load active rules (done) | time=407ms
00:25:47.150 INFO Organization key: krz
00:25:47.167 INFO Preprocessing files...
00:25:47.457 INFO 5 languages detected in 458 preprocessed files (done) | time=288ms
00:25:47.459 INFO 576 files ignored because of inclusion/exclusion patterns
00:25:47.459 INFO 3 directories skipped because of exclusion patterns (content not counted)
00:25:47.460 INFO 28 files ignored because of scm ignore settings
00:25:47.475 INFO Loading plugins for detected languages
00:25:47.475 INFO Load/download plugins
00:25:47.524 INFO Load/download plugins (done) | time=49ms
00:25:47.698 INFO Load project repositories
00:25:47.897 INFO Load project repositories (done) | time=198ms
00:25:47.913 INFO Indexing files...
00:25:47.913 INFO Project configuration:
00:25:47.913 INFO Excluded sources: dist/**, **/testdata/**, internal/web/static/fonts/**, internal/store/migrations/**, **/build-wrapper-dump.json, **/*_test.go
00:25:47.913 INFO Included tests: **/*_test.go
00:25:47.947 INFO 458 files indexed (done) | time=34ms
00:25:47.950 INFO Quality profile for css: Sonar way essentials
00:25:47.955 INFO Quality profile for go: Sonar way essentials
00:25:47.956 INFO Quality profile for shell: Sonar way essentials
00:25:47.956 INFO Quality profile for web: Sonar way essentials
00:25:47.956 INFO Quality profile for yaml: Sonar way essentials
00:25:47.956 INFO ------------- Run sensors on module gitbay
00:25:48.008 INFO Load metrics repository
00:25:48.103 INFO Load metrics repository (done) | time=95ms
00:25:48.111 INFO Sensor cache enabled
00:25:48.114 INFO Load sensor cache
00:25:48.445 INFO Load sensor cache (1 MB) | time=329ms
00:25:48.817 INFO Reflections took 60 ms to scan 1 urls, producing 30 keys and 295 values
00:25:49.507 INFO Sensor IaC YAML File Type Classification Sensor [iac]
00:25:49.546 INFO Sensor IaC YAML File Type Classification Sensor [iac] (done) | time=36ms
00:25:49.546 INFO Sensor GoModuleSecuritySensor [securitygofrontend]
00:25:49.546 INFO Sensor GoModuleSecuritySensor [securitygofrontend] (done) | time=0ms
00:25:49.546 INFO Sensor HTML [web]
00:25:49.956 INFO Sensor HTML [web] (done) | time=410ms
00:25:49.956 INFO Sensor Code Quality and Security for Go [go]
00:25:50.012 INFO 27 folders (386 files) to be analyzed
00:25:58.927 INFO 27/27 folders (386 files) have been analyzed
00:25:58.928 INFO Sensor Code Quality and Security for Go [go] (done) | time=8971ms
00:25:58.928 INFO Sensor IaC CloudFormation Sensor [iac]
00:25:58.928 INFO There are no files to be analyzed for the CloudFormation language
00:25:58.928 INFO Sensor IaC CloudFormation Sensor [iac] (done) | time=0ms
00:25:58.929 INFO Sensor IaC cfn-lint report Sensor [iac]
00:25:58.929 INFO Sensor IaC cfn-lint report Sensor [iac] (done) | time=0ms
00:25:58.929 INFO Sensor IaC Kustomization Sensor [iac]
00:25:58.930 INFO Sensor IaC Kustomization Sensor [iac] (done) | time=0ms
00:25:58.930 INFO Sensor IaC hadolint report Sensor [iac]
00:25:58.930 INFO Sensor IaC hadolint report Sensor [iac] (done) | time=0ms
00:25:58.930 INFO Sensor Java Config Sensor [iac]
00:25:58.930 INFO There are no files to be analyzed for the Java language
00:25:58.931 INFO Sensor Java Config Sensor [iac] (done) | time=0ms
00:25:58.931 INFO Sensor IaC Docker Sensor [iac]
00:25:58.932 INFO There are no files to be analyzed for the Docker language
00:25:58.932 INFO Sensor IaC Docker Sensor [iac] (done) | time=1ms
00:25:58.932 INFO Sensor IaC Ansible Sensor [iac]
00:25:58.933 INFO There are no files to be analyzed for the Ansible language
00:25:58.933 INFO Sensor IaC Ansible Sensor [iac] (done) | time=0ms
00:25:58.933 INFO Sensor IaC ansible-lint report Sensor [iac]
00:25:58.933 INFO Sensor IaC ansible-lint report Sensor [iac] (done) | time=0ms
00:25:58.933 INFO Sensor IaC spectral report Sensor [iac]
00:25:58.934 INFO Sensor IaC spectral report Sensor [iac] (done) | time=0ms
00:25:58.934 INFO Sensor IaC GitHub Actions Sensor [iac]
00:25:58.934 INFO There are no files to be analyzed for the GitHub Actions language
00:25:58.934 INFO Sensor IaC GitHub Actions Sensor [iac] (done) | time=0ms
00:25:58.934 INFO Sensor IaC actionlint report Sensor [iac]
00:25:58.934 INFO Sensor IaC actionlint report Sensor [iac] (done) | time=0ms
00:25:58.934 INFO Sensor IaC Azure Pipelines Sensor [iac]
00:25:58.934 INFO There are no files to be analyzed for the Azure Pipelines language
00:25:58.934 INFO Sensor IaC Azure Pipelines Sensor [iac] (done) | time=0ms
00:25:58.934 INFO Sensor IaC Shell Sensor [iac]
00:25:58.945 INFO 5 source files to be analyzed
00:25:59.022 INFO 5/5 source files have been analyzed
00:25:59.023 INFO Sensor IaC Shell Sensor [iac] (done) | time=88ms
00:25:59.023 INFO Sensor IaC Kubernetes Sensor [iac]
00:25:59.075 INFO There are no files to be analyzed for the Kubernetes language
00:25:59.077 INFO Sensor IaC Kubernetes Sensor [iac] (done) | time=52ms
00:25:59.078 INFO Sensor IaC YAML Sensor [iac]
00:25:59.079 INFO Sensor for language "YAML" is disabled by a feature flag. You can enable it by setting "sonar.featureflag.cloud-security-enable-generic-yaml-and-json-analyzer" to true.
00:25:59.079 INFO Sensor IaC YAML Sensor [iac] (done) | time=0ms
00:25:59.079 INFO Sensor Serverless configuration file sensor [security]
00:25:59.079 INFO 0 Serverless function entries were found in the project
00:25:59.079 INFO 0 Serverless function handlers were kept as entrypoints
00:25:59.079 INFO Sensor Serverless configuration file sensor [security] (done) | time=1ms
00:25:59.079 INFO Sensor AWS SAM template file sensor [security]
00:25:59.084 INFO Sensor AWS SAM template file sensor [security] (done) | time=5ms
00:25:59.085 INFO Sensor EnterpriseTextAndSecretsSensor [textenterprise]
00:25:59.108 INFO Available processors: 4
00:25:59.109 INFO Using 4 threads for analysis.
00:25:59.387 INFO The following rules are activated in the quality profile but will not raise any issue, because they are being rolled out progressively: secrets:S8136. You can enable it by setting: sonar.featureflag.cloud-security-enable-secrets-S8136 to true.
00:25:59.441 INFO Start fetching files for the text and secrets analysis
00:25:59.447 INFO Using Git CLI to retrieve dirty files
00:25:59.470 INFO Retrieving language associated files and files included via "sonar.text.inclusions" that are tracked by git
00:25:59.470 INFO Starting the text and secrets analysis
00:25:59.472 INFO 446 source files to be analyzed for the text and secrets analysis
00:25:59.918 INFO 446/446 source files have been analyzed for the text and secrets analysis
00:25:59.920 INFO Start fetching files for the binary file analysis
00:25:59.920 INFO There are no files to be analyzed for the binary file analysis
00:25:59.925 INFO Sensor EnterpriseTextAndSecretsSensor [textenterprise] (done) | time=840ms
00:25:59.926 INFO Sensor GoSecuritySensor [security]
00:25:59.929 INFO 9 taint analysis rules enabled.
00:26:00.743 INFO Analyzing 2251 UCFGs to detect vulnerabilities.
00:26:01.742 INFO All rules entry points : 32
00:26:01.743 INFO Retained UCFGs : 130
00:26:01.780 INFO 0 / 130 UCFGs simulated, memory usage: 384 MB
00:26:02.048 INFO 130 / 130 UCFGs simulated, memory usage: 427 MB
00:26:02.056 WARN Failed to find InputFile for __unknown_file, check exclusions.
00:26:02.070 WARN Failed to find InputFile for __unknown_file, check exclusions.
00:26:02.076 INFO go security sensor: Begin: 2026-09-06T22:25:59.927202671Z, End: 2026-09-06T22:26:02.075357792Z, Duration: 00:00:02.148
Resolve files to analyze: Begin: 2026-09-06T22:25:59.929692896Z, End: 2026-09-06T22:25:59.930623616Z, Duration: 00:00:00.000
Load type hierarchy and UCFGs: Begin: 2026-09-06T22:25:59.930835074Z, End: 2026-09-06T22:26:00.741747464Z, Duration: 00:00:00.810
Load type hierarchy: Begin: 2026-09-06T22:25:59.930839701Z, End: 2026-09-06T22:25:59.935711409Z, Duration: 00:00:00.004
Load UCFGs: Begin: 2026-09-06T22:25:59.935768255Z, End: 2026-09-06T22:26:00.741694174Z, Duration: 00:00:00.805
Check cache: Begin: 2026-09-06T22:26:00.741932272Z, End: 2026-09-06T22:26:00.742515289Z, Duration: 00:00:00.000
Load cache: Begin: 2026-09-06T22:26:00.742286265Z, End: 2026-09-06T22:26:00.742301928Z, Duration: 00:00:00.000
Create runtime call graph: Begin: 2026-09-06T22:26:00.742540007Z, End: 2026-09-06T22:26:01.348546318Z, Duration: 00:00:00.606
Variable Type Analysis #1: Begin: 2026-09-06T22:26:00.742955500Z, End: 2026-09-06T22:26:01.070326360Z, Duration: 00:00:00.327
Create runtime type propagation graph: Begin: 2026-09-06T22:26:00.743454222Z, End: 2026-09-06T22:26:00.901545421Z, Duration: 00:00:00.158
Run SCC (Tarjan) on 47252 nodes: Begin: 2026-09-06T22:26:00.901887667Z, End: 2026-09-06T22:26:00.974338666Z, Duration: 00:00:00.072
Propagate runtime types to strongly connected components: Begin: 2026-09-06T22:26:00.974476904Z, End: 2026-09-06T22:26:01.070216785Z, Duration: 00:00:00.095
Variable Type Analysis #2: Begin: 2026-09-06T22:26:01.081439136Z, End: 2026-09-06T22:26:01.346701673Z, Duration: 00:00:00.265
Create runtime type propagation graph: Begin: 2026-09-06T22:26:01.081448811Z, End: 2026-09-06T22:26:01.209828689Z, Duration: 00:00:00.128
Run SCC (Tarjan) on 47252 nodes: Begin: 2026-09-06T22:26:01.209951974Z, End: 2026-09-06T22:26:01.281265604Z, Duration: 00:00:00.071
Propagate runtime types to strongly connected components: Begin: 2026-09-06T22:26:01.281413707Z, End: 2026-09-06T22:26:01.346589794Z, Duration: 00:00:00.065
Load config: Begin: 2026-09-06T22:26:01.348589772Z, End: 2026-09-06T22:26:01.542783868Z, Duration: 00:00:00.194
Compute entry points: Begin: 2026-09-06T22:26:01.542855797Z, End: 2026-09-06T22:26:01.741915560Z, Duration: 00:00:00.199
Slice call graph: Begin: 2026-09-06T22:26:01.742212997Z, End: 2026-09-06T22:26:01.745276105Z, Duration: 00:00:00.003
Live variable analysis: Begin: 2026-09-06T22:26:01.745330427Z, End: 2026-09-06T22:26:01.778322713Z, Duration: 00:00:00.032
Taint analysis for go: Begin: 2026-09-06T22:26:01.778552108Z, End: 2026-09-06T22:26:02.048271649Z, Duration: 00:00:00.269
Report issues: Begin: 2026-09-06T22:26:02.048368165Z, End: 2026-09-06T22:26:02.070748919Z, Duration: 00:00:00.022
Store cache: Begin: 2026-09-06T22:26:02.071447840Z, End: 2026-09-06T22:26:02.074662657Z, Duration: 00:00:00.003
00:26:02.077 INFO go security sensor peak memory (pre-GC, max allocation pressure): 770 MB
00:26:02.077 INFO go security sensor peak memory (post-GC, max live footprint): 326 MB
00:26:02.077 INFO Sensor GoSecuritySensor [security] (done) | time=2151ms
00:26:02.084 INFO ------------- Run sensors on project
00:26:02.298 INFO Sensor Deterministic Rule Engine for Go [dre]
00:26:02.352 INFO Extracting bridge from /bridge/bridge-linux-x64.xz
00:26:02.740 INFO Bridge extracted to /var/lib/gitbay-runner/work/build-1078/.scannerwork/.sonartmp/bridge-dre/bridge
00:26:03.345 INFO Sensor Deterministic Rule Engine for Go [dre] (done) | time=1047ms
00:26:03.345 INFO Sensor Deterministic Rule Engine for Shell [dre]
00:26:03.360 INFO Sensor Deterministic Rule Engine for Shell [dre] (done) | time=11ms
00:26:03.361 INFO Sensor SQL Dialect Detection [dre]
00:26:03.361 INFO Sensor SQL Dialect Detection [dre] (done) | time=2ms
00:26:03.362 INFO Sensor DRE Project Telemetry [dre]
00:26:03.362 INFO Sensor DRE Project Telemetry [dre] (done) | time=0ms
00:26:03.362 INFO Sensor GoProjectSensor [go]
00:26:03.363 INFO Sensor GoProjectSensor [go] (done) | time=2ms
00:26:03.363 INFO Sensor Sonar Go A3S Context Collector [go]
00:26:03.363 INFO Sensor Sonar Go A3S Context Collector [go] (done) | time=0ms
00:26:03.363 INFO Sensor goSecurityContextCollectorSensor [securitya3scontextcollector]
00:26:03.364 INFO Sensor goSecurityContextCollectorSensor [securitya3scontextcollector] (done) | time=0ms
00:26:03.364 INFO Sensor JavaScript/TypeScript/CSS analysis [javascript]
00:26:03.605 INFO Detected os: Linux arch: amd64 alpine: false. Platform: LINUX_X64
00:26:03.606 INFO Deploy location /var/lib/gitbay-runner/.sonar/js/node-runtime, tagetRuntime: /var/lib/gitbay-runner/.sonar/js/node-runtime/node, version: /var/lib/gitbay-runner/.sonar/js/node-runtime/version.txt
00:26:03.618 INFO Using embedded Node.js runtime.
00:26:03.618 INFO Using Node.js executable: '/var/lib/gitbay-runner/.sonar/js/node-runtime/node'.
00:26:05.717 INFO Memory configuration: OS (7945 MB), Node.js (2240 MB).
00:26:05.725 INFO gRPC analyze-project server listening on 127.0.0.1:32981
00:26:05.911 INFO Plugin version: [13.8.0.44569]
00:26:07.669 INFO Found 0 tsconfig.json file(s): []
00:26:07.769 WARN Failed to parse file [internal/web/templates/labels.html] at line 8: Unknown word {{index $.LabelColors .Name}}
00:26:07.916 WARN Failed to parse file [internal/web/templates/issues.html] at line 10: Unknown word {{index $.LabelColors .Value}}
00:26:07.916 WARN Failed to parse file [internal/web/templates/issue.html] at line 6: Unknown word {{index $.LabelColors .}}
00:26:07.920 INFO 39 source files to be analyzed
00:26:07.921 INFO 39/39 source files have been analyzed
00:26:07.963 INFO JasminAstConsumer done
00:26:07.964 INFO Hit the cache for 0 out of 38
00:26:07.964 INFO Miss the cache for 38 out of 38: ANALYSIS_MODE_INELIGIBLE [38/38]
00:26:07.964 INFO Sensor JavaScript/TypeScript/CSS analysis [javascript] (done) | time=4600ms
00:26:07.973 INFO Sensor IaC Project Sensor [iac]
00:26:07.973 INFO Sensor IaC Project Sensor [iac] (done) | time=3ms
00:26:07.973 INFO Sensor Zero Coverage Sensor
00:26:08.039 INFO Sensor Zero Coverage Sensor (done) | time=65ms
00:26:08.065 INFO ------------- Gather SCA dependencies on project
00:26:08.292 INFO Dependency analysis skipped
00:26:08.324 INFO CPD Executor 2 files had no CPD blocks
00:26:08.324 INFO CPD Executor Calculating CPD for 224 files
00:26:08.436 INFO CPD Executor CPD calculation finished (done) | time=112ms
00:26:08.447 INFO SCM Publisher SCM provider for this project is: git
00:26:08.447 INFO SCM Publisher 430 source files to be analyzed
00:26:09.176 INFO SCM Publisher 430/430 source files have been analyzed (done) | time=727ms
00:26:09.189 INFO SCM revision ID '03620cf7bd8bed1f3d3e8f9e47039f4762b8c4ff'
00:26:09.424 INFO Analysis report generated in 221ms, dir size=3 MB
00:26:09.961 INFO Analysis report compressed in 536ms, zip size=1 MB
00:26:10.722 INFO Analysis report uploaded in 760ms
00:26:10.723 INFO ANALYSIS SUCCESSFUL, you can find the results at: https://sonarcloud.io/dashboard?id=krz_gitbay
00:26:10.723 INFO Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
00:26:10.723 INFO More about the report processing at https://sonarcloud.io/api/ce/task?id=AaB41D5bZe2HR5N6g4fs
00:26:10.723 INFO ------------- Upload SCA dependency files
00:26:11.320 INFO Sensor cache published successfully
00:26:11.656 INFO Analysis total time: 26.940 s
00:26:11.657 INFO SonarScanner Engine completed successfully
00:26:12.024 INFO EXECUTION SUCCESS
00:26:12.026 INFO Total time: 35.293s