Support SpotBugs

[rock3r]

With the advent of Gradle 5.0, they are planning to deprecate FindBugs as it's basically abandonware and suggest using SpotBugs instead:

The FindBugs plugin has been deprecated because the project is unmaintained and does not work with bytecode compiled for Java 9 and above. Please consider using the SpotBugs plugin instead.

Source: Gradle 5.0 RC1 release notes

SAP should act accordingly.

[tasomaniac]

Here are more links for future reference:

• Gradle plugin man: https://spotbugs.readthedocs.io/en/latest/gradle.html
• On Gradle Plugins portal: https://plugins.gradle.org/plugin/com.github.spotbugs
• Gradle plugin source code: https://github.com/spotbugs/spotbugs-gradle-plugin

[tasomaniac]

Did some integration on the branch: https://github.com/novoda/gradle-static-analysis-plugin/tree/taso/spotbugs

At the time I did this, I used version 1.6.5. That still works fine. But putting 1.6.9 now gives the following error 😢

* What went wrong:
Error while evaluating property 'allSource' of task ':app:spotbugsDebugUnitTest'
> path may not be null or empty string. path='null'

The error is kinda cryptic but it looks like it means source is not set correctly.

[tasomaniac]

Also I have problems with tests. Tests cannot find SpotBugsTask and just fails early. It works fine on the sample.

[tasomaniac]

This work that I mentioned above is just garbage since the release of the SpotBugs plugin version 2.0.0. Initially after talking to @mr-archano last year, I tried to make use of the same structure that we have for Findbugs. The reason was that the SpotBugs plugin also uses internal APIs of Gradle anyways.

That takes a lot of assumptions and it seems like the plugin being in development evolves outside of Gradle. There is even a ticket to remove that Internal API usages. spotbugs/spotbugs-gradle-plugin#104

Long story short, I started to do an integration from scratch without copying the Findbugs and other code quality tool integrations.

[tasomaniac]

Done in #209