Automatic Analysis

SonarCloud can automatically analyze your code simply by reading it from your repository, without the need to configure a CI-based analysis.

When you first import a project that is compatible with automatic analysis, the first analysis behaves differently from subsequent analyses. On the first analysis not only will the main branch be analyzed, but, also the most recently active pull requests, up to a maximum of five. After that, automatic analysis will trigger a new analysis on each push to the default branch and on each push to any pull request branch.


Currently, automatic analysis has the following limitations:

  • It is only available for GitHub repositories.
  • Branch analysis (analysis of non-pull request branches other than the main branch) is not supported.
  • Multiple projects bound to a single repository (the monorepo strategy) are not supported.
  • Many compiled languages (C and Objective-C) cannot be analyzed. Java can be analyzed automatically, but only a partial set of rules is supported.
  • T-SQL and PL/SQL cannot be analyzed automatically because they share the same file extension, so this requires manual configuration in the CI-based mode.
  • Code coverage information is not supported.
  • Import of external rule engine reports is not supported.

Supported languages

Automatic analysis is available for most of the languages that SonarCloud supports:

Activating automatic analysis

For new projects:

  • After importing a project from GitHub, SonarCloud will automatically check whether your project is eligible for automatic analysis. This should take a few seconds.
    • SonarCloud will deem a project eligible for automatic analysis only if fewer than 20% of the lines of code in the project are in a non-compatible language. 
    • For a Java project to be eligible, the amount of Java code cannot exceed 10MB.
    • SonarCloud will reject a project for automatic analysis if it contains a file (see Presence of a properties file).
  • If your project is eligible, SonarCloud will automatically trigger the first analysis. On this first analysis, the system will analyze the main branch of the project and the five most recently active pull requests. All you have to do is wait for the analysis to finish.
  • If your project is not compatible, SonarCloud will suggest other analysis methods such as using a CI tool.
  • You can force automatic analysis on an initially non-eligible project. However, doing this is not recommended as it will typically not provide useful information. To force automatic analysis, do one of the following:
    • From your project’s homepage, click the Force Automatic Analysis button.
    • From your project’s Administration > Analysis Method page, turn automatic analysis on.

For existing projects:

  • Go to your project’s Administration > Analysis Method page and turn automatic analysis on.
  • The Analysis Method page will display a compatibility check, so you are aware of our recommendations for your specific project.

Presence of a properties file

If you import a project that already contains a file, SonarCloud will deem the project ineligible for automatic analysis. You can still force automatic analysis if you choose. The reason for this limitation is that the presence of a in a newly imported project usually means that the customer is migrating from SonarQube and probably wishes to continue with the same CI-based configuration as they were using on that platform, particularly since automatic analysis does not offer all of the same features as CI-based analysis.

Analysis Method Indicator

If a project uses automatic analysis, then in the Project Overview > Information under Analysis Method the system will display Analyzed by SonarCloud:

Shows if a project has been analyzed automatically.

Indicated the last analysis method used.

Conflict with CI-based Analysis

Automatic analysis is not intended to be used in conjunction with CI-based analysis.

If you do enable automatic analysis you must ensure that you do not have any CI-based analyses configured. If you do then these CI-based analyses will fail and cause a failure in your build process.

Similarly, if you wish to use a CI-based analysis on a project, you must ensure that automatic analysis is disabled for that project.

This is done to prevent duplicate analyses from being sent to SonarCloud that would cause problems in your project activity reports.

Deactivating automatic analysis

Go to your project’s Administration > Analysis Method page and turn automatic analysis off.

From the same page, you can then follow one of our tutorials for configuring SonarCloud analyses with another method.

Additional analysis configuration

You can add more configuration to your analyses by adding a file to your repository’s default branch. Note that this is different from the file used for CI-based analysis.

Here are the supported optional settings for the file:

# Path to sources
# sonar.sources=
# sonar.exclusions=
# sonar.inclusions=

# Path to tests
# sonar.tests=
# sonar.test.exclusions=
# sonar.test.inclusions=

# Source encoding
# sonar.sourceEncoding=

# Exclusions for copy-paste detection
# sonar.cpd.exclusions=

# Python version (for python projects only)
# sonar.python.version=

Note that some of these settings can also be configured from the SonarCloud UI. In your project’s Administration > General Settings > Analysis Scope, you can define file exclusions and inclusions. If you have different options set on the UI and the file, SonarCloud will only take into account the one from the file.

Automatic analysis for Java projects

Automatic analysis provides the quickest way to get your Java project up and running on SonarCloud and see code analysis results fast. 

However, in the case of Java, automatic analysis does currently have some limitations:

  • To be eligible for automatic analysis, your Java project must use either Maven or Gradle and the total amount of code in the project must be less than 10MB.
  • Security vulnerability rules are not yet supported.
  • Rules outside the Sonar way quality profile are not yet supported.
  • Of the rules in the Sonar way quality profile, only a subset (about 80%) are currently supported.

Automatic analysis for .NET projects

SonarCloud automatic analysis now also supports .NET projects. .NET Core and .NET 5 and .NET 6 projects can be analyzed but are subject to some limitations: 

  • Projects must contain at least 80% code in languages compatible with .NET. The amount of .NET code for automatic analysis is calculated by adding the sum of *.cs and *.vb files together.
  • Security vulnerability rules are not yet supported.
  • Projects must contain at least one XML file -  *.csproj or *.vbproj. A combination of both file types is acceptable. 
  • The csproj/vbproj files must have “Project” as the root element, and “Sdk” as the project attribute. For example, <Project Sdk="Microsoft.NET.Sdk">.
  • Projects must not contain *.shproj file extensions.

With these limitations in mind, the next step in your Java or .NET project onboarding is to set up CI-based analysis. You can find more information on that here. In the meantime, the capabilities of automatic analysis will continue to evolve and improve.

© 2008-2023, SonarCloud by SonarSource SA. All rights reserved.