I have been adding support for static analysis using sonar to all our repositories including those containing go.
I have fun into a problem with the use of cgo - see https://community.sonarsource.com/t/how-to-handle-cgo/75610

sonar supports vanilla go just fine but is confused by C files that are compiled using cgo directives.

It supports two ways to get information about C files.

1. A build wrapper which acts a bit like strace and traps build commands
   or
2. It can import compile-commands.json files produced by for example CMake when compiling C or C++ code.

Neither of these work with cgo (see linked sonar issue for details).
As a workaround I have to compile C files some other way and pass that information to sonar.

Obviously this is a limitation/bug in sonar and not golang.

I am raising it here as relates to interoperating with third party tools.
This is not a bug report but might lead possibly lead to feature request.

I think perhaps the tool suite needs something that will list C source files consumed as part of the build.
One solution would be something that generates a well known format like for example "compile-commands.json"
or which could be used to contruct one.

In #36995 (comment)
the suggestion is made to use go build -x or go list --json

Neither provide information about the C files consumed by cgo in a useful form.
(Although interestingly both quote warnings produced by the compiler).

Although cgo seems to use the host C compiler under the hood for this (on my linux box it uses gcc libraries anyway) it is not as simple "gcc " so it is not picked up by the build-wrapper.
Likewise the names of the C source files do not appear in go list --json

Grepping for // #include "my_c_file.c"
is not sufficient as it does not take #includes in the included file into account.

What version of Go are you using (go version)?

1.17

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOHOSTARCH="amd64"
GOHOSTOS="linux"