SonarSource/sonarqube · error · SarifDeserializationException

FILE_NOT_FOUND

FILE_NOT_FOUND

Error message

Failed to read SARIF report at '%s': %s

What it means

java.io.FileNotFoundException raised while reading the report is wrapped into SarifDeserializationException with Category.FILE_NOT_FOUND and message 'Failed to read SARIF report at %s: %s'. It means the Path given to SarifSerializerImpl.deserialize does not exist (or, on some platforms, is a directory or is otherwise unopenable) — Jackson's readValue(File,...) opens the file and fails before any JSON parsing happens.

Source

Thrown at sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java:95

          public Object handleInstantiationProblem(DeserializationContext ctxt, Class<?> instClass, Object argument, Throwable t) throws IOException {
            if (!instClass.equals(SarifSchema210.Version.class)) {
              return NOT_HANDLED;
            }
            throw new UnsupportedSarifVersionException(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, argument), t);
          }
        })
        .readValue(reportPath.toFile(), SarifSchema210.class);
    } catch (UnsupportedSarifVersionException e) {
      throw new SarifDeserializationException(Category.MAPPING, e.getMessage(), e);
    } catch (JsonParseException e) {
      throw new SarifDeserializationException(Category.SYNTAX, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (JsonMappingException e) {
      if (e.getMessage() != null && (e.getMessage().contains("out of range") || e.getMessage().contains("overflow"))) {
        throw new SarifDeserializationException(Category.VALUE, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
      }
      throw new SarifDeserializationException(Category.MAPPING, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (FileNotFoundException e) {
      throw new SarifDeserializationException(Category.FILE_NOT_FOUND, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (IOException e) {
      throw new IllegalStateException(format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    }
  }

  private static class UnsupportedSarifVersionException extends IOException {

    public UnsupportedSarifVersionException(String message, Throwable t) {
      super(message, t);
    }
  }
}

View on GitHub (pinned to 184c821202)

Solutions

  1. Check the exact path in the message: verify the file exists at that location (ls/Get-Item) and that the process user can read it
  2. Use an absolute path in sonar.sarifReportPaths or verify the scanner working directory; ensure the report-generation step runs before the SonarQube scan and its artifact is not cleaned
  3. Check case sensitivity and file extension; on Linux, 'Report.SARIF' != 'report.sarif'
  4. In code, call Files.exists(reportPath) / Files.isRegularFile(reportPath) before deserialize and surface a clear message

Example fix

// before
Path reportPath = Paths.get("reports/scan.sarif"); // may not exist
SarifSchema210 sarif = serializer.deserialize(reportPath);
// after
Path reportPath = Paths.get("reports/scan.sarif").toAbsolutePath();
if (!java.nio.file.Files.isRegularFile(reportPath)) {
  throw new IllegalStateException("SARIF report missing: " + reportPath);
}
SarifSchema210 sarif = serializer.deserialize(reportPath);
Defensive patterns

Strategy: validation

Validate before calling

requireNonNull(reportPath, "reportPath");
if (!Files.isRegularFile(reportPath)) {
  throw new IllegalArgumentException("SARIF report not found: " + reportPath.toAbsolutePath());
}

Type guard

boolean sarifReportExists(Path p) {
  return p != null && Files.isRegularFile(p) && Files.isReadable(p);
}

Try / catch

try {
  SarifSchema210 sarif = serializer.deserialize(reportPath);
} catch (SarifDeserializationException e) {
  if (e.getCategory() == Category.FILE_NOT_FOUND) {
    LOG.warn("SARIF report {} is missing; skipping import", reportPath);
  } else throw e;
}

Prevention

When it happens

Trigger: Calling SarifSerializer.deserialize(Path) with a path that does not exist, was deleted between report generation and import, is a directory, or the path string passed via sonar.sarifReportPaths contains a typo/relative path resolved against the wrong working directory.

Common situations: sonar.sarifReportPaths configured with a wrong or relative path in CI where the scanner's working directory differs; report generated conditionally and skipped in this build; artifacts cleaned before the SonarQube scan step; case-sensitivity mismatch on Linux for paths authored on Windows/macOS.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/ffdfa4d0df21cff2. Report an issue: GitHub.