Missing Sarif report for Razor Views for .NET Core 3.1 and .NET 5 SDK

[pavel-mikula-sonarsource]

Context

Building .NET Core app with Razor pages triggers two builds under the hood. First csc build generates Project.dll assembly, second csc build generates Project.Views.dll assembly.

We have special handling for this in our integration targets to set ErrorLog PropertyGroup to get Sarif report out of the analysis. Basically we want to get the main ErrorLog from first build and then, we want also the second ErrorLog from generating the Views.

sonar-scanner-msbuild/src/SonarScanner.MSBuild.Tasks/Targets/SonarQube.Integration.targets

Lines 482 to 488 in 9329159

	<Target Name="SetRazorCodeAnalysisProperties" BeforeTargets="RazorCoreCompile" AfterTargets="CopyFilesToOutputDirectory">
	<PropertyGroup Condition=" $(ErrorLog) == $(SonarCompileErrorLog) ">
	<!-- Keep the path so that we could set SonarQubeSetting with sonar.language.roslyn.reportFilePaths -->
	<RazorSonarCompileErrorLog>$(TargetDir)$(TargetName)$(RazorTargetNameSuffix)$(TargetExt).RoslynCA.json</RazorSonarCompileErrorLog>
	<ErrorLog>$(RazorSonarCompileErrorLog)</ErrorLog>
	</PropertyGroup>
	</Target>

Problem

While this was probably working for original versions of the RazorCoreCompile targets in .NET Core 2 SDK, there were some braking changes in Razor SDK 3.1 so we don't get the Sarif Report for Razor Views assembly anymore.

.NET Core 3.1 and .NET 5 Razor SDK target for RazorCoreCompile uses this Csc parameter:

         ErrorLog="$(RazorCompilationErrorLog)"

Solution

We need to update our SonarQube.Integration.targets to set both properties to the same value:

<ErrorLog>$(RazorSonarCompileErrorLog)</ErrorLog> 
<RazorCompilationErrorLog>$(RazorSonarCompileErrorLog)</RazorCompilationErrorLog> 

[mickael-caro-sonarsource]

Hi @pavel-mikula-sonarsource

Thanks for this.

What do we do with the original value "**RoslynCA.json" ? Is it a breaking change if we change it to RazorSonarCompileErrorLog ?

[pavel-mikula-sonarsource]

The RoslyNCA.json value is in RazorSonarCompileErrorLog variable and we'll keep using it as it was. We should

• keep it in ErrorLog for .NET Core 2 SDK, it is ignored in .NET Core 3 and above
• set it also to the RazorCompilationErrorLog to do the same thing for .NET Core 3