Qodana PR mode on Azure Pipelines: problems reported in files outside the PR

Problem

When Qodana runs in pull request mode as part of an Azure Pipelines PR build, the scan reports problems in files that the pull request does not touch, and the scan fails. Rebasing the branch onto the target branch and re-running produces a clean result.

Cause

In PR mode the Qodana Azure task compares the analyzed code against the merge base of the source and target branches (the commit where the branch forked from the target). Azure builds a PR by pre-merging the branch into the current target branch head, so the checkout also contains everything merged into the target after that fork point. Problems introduced into the target branch after the fork point fall into the analysis scope and are reported as new, even though they are not part of the PR.

Resolution

Point Qodana at the current target branch head instead of the fork point. The Qodana task uses the QODANA_PR_SHA variable as the comparison commit when it is set. Add this step before the Qodana task in the pipeline:

- script: |
    TARGET_BRANCH=${SYSTEM_PULLREQUEST_TARGETBRANCH#refs/heads/}
    git fetch origin $TARGET_BRANCH
    echo "##vso[task.setvariable variable=QODANA_PR_SHA]$(git rev-parse origin/$TARGET_BRANCH)"
  displayName: Use target branch head as Qodana diff base

Because the PR build checks out the branch pre-merged into the current target branch, comparing against the target branch head covers exactly what the PR introduces. Problems that exist only in the target branch are no longer reported.