From 9bf7c126a1c17f11278a5c55416b867a27a73d5e Mon Sep 17 00:00:00 2001 From: Brandon Davis Date: Thu, 9 Oct 2025 06:21:35 -0500 Subject: [PATCH] SQSCANGHA-122 Include caveats for running SCA (#213) --- README.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index d67f936..6a79c2e 100644 --- a/README.md +++ b/README.md @@ -89,10 +89,13 @@ This GitHub Action will not work for all technologies. If you are in one of the * **Your code is built with Gradle**. Read the documentation about our SonarScanner for Gradle in SonarQube [Server](https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/sonarscanner-for-gradle/) and [Cloud](https://docs.sonarsource.com/sonarqube-cloud/advanced-setup/ci-based-analysis/sonarscanner-for-gradle/). * **You want to analyze a .NET solution**. Read the documentation about our SonarScanner for .NET in SonarQube [Server](https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/dotnet/introduction/) and [Cloud](https://docs.sonarsource.com/sonarqube-cloud/advanced-setup/ci-based-analysis/sonarscanner-for-dotnet/introduction/). -**Also, do not use this GitHub action if:** +**Do not use this GitHub action if:** * You want to run the action on C, C++, or Objective-C projects on a 32-bits system - build wrappers support only 64-bits OS. +**If you want to use Software Composition Analysis (SCA)** + +Dependency scanning with SonarQube Advanced Security SCA may not work correctly if scanning requires on-the-fly manifest file generation. See the SCA analysis environment requirement documentation for [Cloud](https://docs.sonarsource.com/sonarqube-cloud/advanced-security/analyzing-projects-for-dependencies-sca#appropriate-environment) or [Server](https://docs.sonarsource.com/sonarqube-server/advanced-security/analyzing-projects-for-dependencies#appropriate-environment). ## Key requirements