SonarSource/sonarqube · critical · IllegalStateException

Failed to read SARIF report at '%s': %s

Error message

Failed to read SARIF report at '%s': %s

What it means

Any other IOException that is not FileNotFoundException (and not one of the SARIF-specific UnsupportedSarifVersionException cases) is rethrown as an IllegalStateException with message 'Failed to read SARIF report at %s: %s'. This represents unexpected I/O problems while reading the file — permission issues surfaced as other IOExceptions, filesystem/device errors, stream closed, etc. Unlike the category-based SarifDeserializationException cases, it is treated as an unexpected runtime condition (fails the import hard).

Source

Thrown at sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java:97

              return NOT_HANDLED;
            }
            throw new UnsupportedSarifVersionException(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, argument), t);
          }
        })
        .readValue(reportPath.toFile(), SarifSchema210.class);
    } catch (UnsupportedSarifVersionException e) {
      throw new SarifDeserializationException(Category.MAPPING, e.getMessage(), e);
    } catch (JsonParseException e) {
      throw new SarifDeserializationException(Category.SYNTAX, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (JsonMappingException e) {
      if (e.getMessage() != null && (e.getMessage().contains("out of range") || e.getMessage().contains("overflow"))) {
        throw new SarifDeserializationException(Category.VALUE, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
      }
      throw new SarifDeserializationException(Category.MAPPING, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (FileNotFoundException e) {
      throw new SarifDeserializationException(Category.FILE_NOT_FOUND, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (IOException e) {
      throw new IllegalStateException(format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    }
  }

  private static class UnsupportedSarifVersionException extends IOException {

    public UnsupportedSarifVersionException(String message, Throwable t) {
      super(message, t);
    }
  }
}

View on GitHub (pinned to 184c821202)

Solutions

1. Read the cause chain of the IllegalStateException to identify the underlying IOException; fix that root cause (permissions, mount, disk)
2. Verify the process user has read permission on the file and every directory in its path (chmod/chown; check ACLs in containers)
3. Ensure the report lives on stable local storage during the scan; copy it from network shares before importing
4. Re-run the scan; if the file vanished mid-read, serialize report production and the SonarQube step so the artifact is not concurrently deleted

Example fix

// before
SarifSchema210 sarif = serializer.deserialize(reportPath); // IllegalStateException on IO error
// after
try {
  SarifSchema210 sarif = serializer.deserialize(reportPath);
} catch (IllegalStateException e) {
  LOG.error("Unreadable SARIF report {}: {}", reportPath, e.getCause());
  throw e;
}

if (!Files.isReadable(reportPath)) {
  throw new AccessDeniedException(reportPath.toString());
}

boolean canReadReport(Path p) {
  try {
    return p != null && Files.isRegularFile(p) && Files.isReadable(p);
  } catch (IOException e) {
    return false;
  }
}

try {
  SarifSchema210 sarif = serializer.deserialize(reportPath);
} catch (IllegalStateException e) {
  Throwable cause = e.getCause();
  LOG.error("I/O failure reading SARIF report {}: {}", reportPath, cause != null ? cause : e.getMessage());
  throw e; // treat as unrecoverable environment problem
}

When it happens

Trigger: SarifSerializerImpl.deserialize(Path) calls readValue(File,...); the underlying FileInputStream or read operation throws an IOException other than FileNotFoundException — e.g. access denied surfacing as a non-FNF IOException on some filesystems, I/O error while reading from a network mount, file deleted mid-read, or an IOException from a custom handler chain.

Common situations: Report on a network/ephemeral volume that dropped mid-scan; file permissions changed between check and read; container user lacks read access to the mounted artifact; disk/IO errors on the build agent; races where the file is removed while the scanner reads it.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

• Can not write to file
• Can not delete
• Can not move file to
• Directory could not be created
• Can not open file

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/b695da7b991c7888. Report an issue: GitHub.