sonar.sources is fed automatically if you analyze with Maven, Gradle, or MSBuild. Everyone else (using the vanilla SonarQube Scanner) must provide a value manually.
But since analysis is assumed to start from the project root, then we can assume that project sources will be found by a recursive search of the current directory. In other words, let's default to sonar.sources=..
Because we now default project name (to project key), and project version, this change allows a localhost (i.e. first trial) analysis, without the need to create a sonar-project.properties file,
A minimal production analysis command looks like this: