Checkpoint Lab — Language Analysis, Sensors, SCM Data, and Source-Code Indexing

1. Checkpoint scenario and assumptions

Operate only on the disposable academy-sonarqube-p08 project and synthetic repository from Lesson 2. Record Community Build 26.9.0.129388, Scanner CLI 8.1.0.6389, Git version, scanner JRE mode, exact project key, and whether any external analyzer/report import is enabled. The mandatory lab uses no commercial feature, CI provider, third-party plugin, Kubernetes, identity provider, or production database change.

2. Preflight inventory

cd sonar-p08
pwd
git status --short
git rev-parse HEAD | tee evidence-revision.txt
git rev-parse --is-shallow-repository | tee evidence-shallow.txt
git ls-files | sort | tee evidence-tracked-files.txt
git status --ignored --short | tee evidence-ignored-files.txt
sonar-scanner --version | tee evidence-scanner-version.txt
sed -E '/token|password|secret/Id' sonar-project.properties | tee evidence-project-properties.txt

If the working tree is dirty, either commit the intended lab change or record why it is dirty before analysis. Do not silently scan unrecorded source mutations.

3. Write predictions before execution

4. Execute the controlled good run

read -rsp 'Project-analysis token: ' SONAR_TOKEN; echo
export SONAR_TOKEN SONAR_HOST_URL='http://127.0.0.1:9000'
sonar-scanner -X -Dsonar.host.url="$SONAR_HOST_URL" 2>&1 | tee evidence-good-debug.log
cp .scannerwork/report-task.txt evidence-good-report-task.txt
grep -Ei 'project configuration|indexed|excluded|included|sensor|language|scm|blame'   evidence-good-debug.log | tee evidence-good-scope-summary.txt

Extract ceTaskId from the task file and preserve the terminal Compute Engine status before recording any gate result. If scanner upload fails, do not fabricate CE/gate evidence.

5. Inject exactly one reversible defect

Choose one of these paths, not both, so the causal variable stays clear.

Option A — exclusion defect

cp sonar-project.properties sonar-project.properties.good
printf '
sonar.exclusions=src/**
' >> sonar-project.properties
sonar-scanner -X -Dsonar.host.url="$SONAR_HOST_URL" 2>&1 | tee evidence-broken-exclusion.log || true

Prediction: most owned Python source disappears while infra and tests follow their own scopes. Preserve the indexed-file/measure change.

Option B — shallow-SCM defect

cd ..
rm -rf sonar-p08-shallow
git clone --depth 1 "file://$PWD/sonar-p08" sonar-p08-shallow
cd sonar-p08-shallow
git rev-parse --is-shallow-repository | tee evidence-broken-shallow.txt
sonar-scanner -X -Dsonar.host.url="$SONAR_HOST_URL" 2>&1 | tee evidence-broken-scm.log || true

Prediction: SCM/blame evidence is degraded/skipped and analysis may fail. Preserve the actual result.

6. Repair the exact defect

Repair A

mv sonar-project.properties.good sonar-project.properties
sonar-scanner -X -Dsonar.host.url="$SONAR_HOST_URL" 2>&1 | tee evidence-repaired.log
cp .scannerwork/report-task.txt evidence-repaired-report-task.txt

Repair B

git fetch --unshallow 2>/dev/null || git fetch --depth=2147483647
git rev-parse --is-shallow-repository | tee evidence-repaired-shallow.txt
sonar-scanner -X -Dsonar.host.url="$SONAR_HOST_URL" 2>&1 | tee evidence-repaired.log
cp .scannerwork/report-task.txt evidence-repaired-report-task.txt

Do not compensate by changing project key, lowering the Quality Gate, granting admin credentials, deleting logs/cache, disabling TLS, editing database/search state, or globally disabling SCM.

7. Required evidence packet

8. Verification checklist

• Exact source revision and project key are recorded.
• Source and test scopes are disjoint and proved from logs.
• Indexed-file evidence matches the predicted roots and exclusions.
• Custom suffix behavior is recorded or explicitly absent if reverted.
• SCM shallow/full state is independently recorded.
• Sensor/report warnings are preserved rather than hidden.
• Each successful upload is correlated to its own Compute Engine task.
• Gate state is recorded separately from scanner/CE success.
• The broken evidence remains available after repair.
• No token value or proprietary source appears in the packet.

9. Guarded cleanup and rollback

1. Revoke the disposable project-analysis token and prove the token is no longer usable for a harmless authenticated project request.
2. Unset SONAR_TOKEN.
3. Restore the known-good sonar-project.properties if Option A was used.
4. Delete only the shallow clone/fixture after the evidence packet is complete.
5. Delete the disposable Sonar project only if no later chapter will reuse it.
6. Leave shared scanner caches and server/database/search volumes untouched.

10. What Chapter 08 adds to the operating model

You can now define analysis scope as a governed, evidence-backed contract: exact base directory, source/test roots, filters, language mapping, generated/vendor policy, SCM state, sensor/report inputs, scanner report/task and downstream policy state. Chapter 09 can therefore teach rules and quality profiles against a known analyzed file set instead of debating findings from an unknown scope.

Knowledge check

Official references and version notes

• Community Build — Setting initial scope — source/test roots, simple-path rules, and project-base-directory semantics.
• Community Build — Path-based inclusions and exclusions — wildcard filtering after the initial scope.
• Community Build — Verifying analysis scope — debug-log indexing evidence and SonarScanner Context.
• Community Build — File suffixes — language recognition through sonar.<language>.file.suffixes.
• Community Build — Checked-out code and SCM integration — full-clone/blame requirements and shallow-clone behavior.
• Community Build — Other scope adjustments — SCM ignore behavior and sonar.scm.exclusions.disabled.
• Community Build — Supported languages — current analyzer/language matrix.
• Community Build — External issues and generic report format.
• Scanner environment requirements — current JRE auto-provisioning/runtime boundary.