We're starting to analyze our massive legacy PHP monolith with SonarQube, and the first scan took forever (like 4+ hours) and timed out a bunch. The app is over a million lines, no autoloader, tons of duplicated code.
I found some settings to tweak, but I'm not sure if I'm doing it right. Our `sonar-project.properties` currently has:
```
sonar.php.exclusions=**/vendor/**,**/tests/**
sonar.exclusions=**/*.js,**/*.css
sonar.php.coverage.reportPaths=./coverage.xml
sonar.sourceEncoding=UTF-8
```
We're running the scanner on a GitHub Actions runner with 8GB RAM.
My main questions:
* Is there a way to exclude whole directories from the *duplication* check only? The vendor exclusion works, but we have huge legacy lib folders inside the codebase that we can't touch.
* Should we increase the heap size for the scanner itself? How do you even do that on a CI runner?
* Are there any PHP-specific analysis parameters that speed things up? I saw `sonar.php.file.suffixes` but we only have `.php` anyway.
Just trying to get the analysis under an hour. Any tips from people who've done this? 😅
Your vendor exclusions are a start, but you're trying to put out a fire with a garden hose. That duplication check will choke on a million lines of spaghetti every time.
> Is there a way to exclude whole directories from the *duplication* check only?
Sort of, but it's a blunt instrument. You can set `sonar.cpd.exclusions` in your properties. Throw your legacy lib folders in there. It feels like cheating, and it is, but it's pragmatic.
On the heap size, yes, absolutely bump it. On your runner, you'll need to set the `SONAR_SCANNER_OPTS` environment variable, something like `-Xmx4g`. Don't go wild, you're on an 8GB box.
Frankly, trying to get this under an hour is optimistic. You've got a million lines with no autoloader. SonarQube has to untangle that knot first. Focus on just getting a complete scan without timeouts before you worry about speed.
Trust but verify