SonarQube升级至10.8后GitHub Actions中SonarScanner执行失败求助

将SonarQube从9.8版本升级至10.8版本后，在GitHub Actions中执行SonarScanner时出现如下错误：

ERROR: Error during SonarScanner execution
java.lang.UnsupportedClassVersionError: org/sonar/batch/bootstrapper/EnvironmentInformation has been compiled by a more recent version of the Java Runtime (class file version 61.0), this version of the Java Runtime only recognizes class file versions up to 55.0
    at java.base/java.lang.ClassLoader.defineClass1(Native Method)
    at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1017)
    at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:174)
    at java.base/java.net.URLClassLoader.defineClass(URLClassLoader.java:555)
    at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:458)
    at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:452)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:451)
    at org.sonarsource.scanner.api.internal.IsolatedClassloader.loadClass(IsolatedClassloader.java:82)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
    at org.sonarsource.scanner.api.internal.batch.DefaultBatchFactory.createBatch(DefaultBatchFactory.java:32)
    at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:566)
    at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)
    at com.sun.proxy.$Proxy0.execute(Unknown Source)
    at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)
    at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)
    at org.sonarsource.scanner.cli.Main.execute(Main.java:112)
    at org.sonarsource.scanner.cli.Main.execute(Main.java:75)
    at org.sonarsource.scanner.cli.Main.main(Main.java:61)
ERROR: 
ERROR: Re-run SonarScanner using the -X switch to enable full debug logging.

相关配置文件如下：

GitHub Actions工作流文件 #

on:
  push:
    branches:
      - "develop/**"
  workflow_dispatch:
  pull_request:
    types: [opened, reopened, synchronize]

name: SonarQube Scan
jobs:
  sonarqube:
    name: SonarQube 
    runs-on: [ pogi-runner ]
    steps:
      - name: Checking out
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: SonarQube Scan
        uses: pogi-private/pogi-sonarqube-action@main
        with:
          host: ${{ secrets.POGI_SONARQUBE_HOST }}
          login: ${{ secrets.POGI_SONARQUBE_TOKEN }}

自定义Action的Dockerfile #

FROM sonarsource/sonar-scanner-cli:4.7.0

COPY cacerts /usr/lib/jvm/default-jvm/jre/lib/security/cacerts

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

Entrypoint脚本 #

#!/bin/bash

set -e

REPOSITORY_NAME=$(basename "${GITHUB_REPOSITORY}")

if [[ ! -z "${INPUT_PASSWORD}" ]]; then
  echo "::warning ::Running this GitHub Action without authentication token is NOT recommended!"
  SONAR_PASSWORD="${INPUT_PASSWORD}"
else
  SONAR_PASSWORD=""
fi

if [[ -f "${INPUT_PROJECTBASEDIR%/}pom.xml" ]]; then
  echo "::error file=${INPUT_PROJECTBASEDIR%/}pom.xml::Maven project detected. You should run the goal 'org.sonarsource.scanner.maven:sonar' during build rather than using this GitHub Action."
  exit 1
fi

if [[ -f "${INPUT_PROJECTBASEDIR%/}build.gradle" ]]; then
  echo "::error file=${INPUT_PROJECTBASEDIR%/}build.gradle::Gradle project detected. You should use the SonarQube plugin for Gradle during build rather than using this GitHub Action."
  exit 1
fi

unset JAVA_HOME

if [[ ! -f "${INPUT_PROJECTBASEDIR%/}sonar-project.properties" ]]; then
  [[ -z "${INPUT_PROJECTKEY}" ]] && SONAR_PROJECTKEY="${REPOSITORY_NAME}" || SONAR_PROJECTKEY="${INPUT_PROJECTKEY}"
  [[ -z "${INPUT_PROJECTNAME}" ]] && SONAR_PROJECTNAME="${REPOSITORY_NAME}" || SONAR_PROJECTNAME="${INPUT_PROJECTNAME}"
  [[ -z "${INPUT_PROJECTVERSION}" ]] && SONAR_PROJECTVERSION="" || SONAR_PROJECTVERSION="${INPUT_PROJECTVERSION}"
  sonar-scanner \
    -Dsonar.host.url="${INPUT_HOST}" \
    -Dsonar.projectKey="${SONAR_PROJECTKEY}" \
    -Dsonar.projectName="${SONAR_PROJECTNAME}" \
    -Dsonar.projectVersion="${SONAR_PROJECTVERSION}" \
    -Dsonar.projectBaseDir="${INPUT_PROJECTBASEDIR}" \
    -Dsonar.login="${INPUT_LOGIN}" \
    -Dsonar.password="${SONAR_PASSWORD}" \
    -Dsonar.sources="${INPUT_PROJECTBASEDIR}" \
    -Dsonar.sourceEncoding="${INPUT_ENCODING}"
else
  sonar-scanner \
    -Dsonar.host.url="${INPUT_HOST}" \
    -Dsonar.login="${INPUT_LOGIN}" \
    -Dsonar.password="${SONAR_PASSWORD}"
fi

• 类文件版本61.0对应Java 17，55.0对应Java 11。SonarQube 10.8强制要求SonarScanner使用Java 17运行，但当前自定义Action依赖的sonarsource/sonar-scanner-cli:4.7.0基础镜像默认搭载Java 11。
• Entrypoint脚本中unset JAVA_HOME的操作，会直接清除Java环境变量配置，导致无法切换到更高版本的Java。

方案1：更新SonarScanner CLI镜像（推荐） #

SonarScanner CLI 5.0.0及以上版本默认使用Java 17，完全适配SonarQube 10.8。修改自定义Action的Dockerfile：

# 使用支持Java17的SonarScanner CLI稳定版本，例如5.0.1
FROM sonarsource/sonar-scanner-cli:5.0.1

# 新版本镜像的Java路径已变更，调整cacerts复制路径
# 可通过`docker run --rm sonarsource/sonar-scanner-cli:5.0.1 echo $JAVA_HOME`确认具体路径
COPY cacerts /usr/lib/jvm/java-17-openjdk-amd64/jre/lib/security/cacerts

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

同时修改Entrypoint脚本，删除unset JAVA_HOME这一行——新版本镜像已自动配置好Java 17的环境变量，无需额外操作。

方案2：在现有镜像中安装并配置Java 17（临时应急） #

若暂时无法更新镜像，可在Dockerfile中手动安装Java 17并配置环境变量：

1. 修改Dockerfile：

FROM sonarsource/sonar-scanner-cli:4.7.0

# 安装OpenJDK 17，清理apt缓存减少镜像体积
RUN apt-get update && apt-get install -y --no-install-recommends openjdk-17-jdk && rm -rf /var/lib/apt/lists/*

# 替换Java17的cacerts文件
COPY cacerts /usr/lib/jvm/java-17-openjdk-amd64/jre/lib/security/cacerts

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

2. 修改Entrypoint脚本，删除unset JAVA_HOME，添加Java 17的环境变量配置：

# 替换原unset JAVA_HOME的代码
export JAVA_HOME="/usr/lib/jvm/java-17-openjdk-amd64"
export PATH="$JAVA_HOME/bin:$PATH"

修改完成后，推送自定义Action代码到pogi-private/pogi-sonarqube-action仓库的main分支，重新触发GitHub Actions工作流，确认扫描任务正常执行。

内容的提问来源于stack exchange，提问作者Lagot