This is the official Gradle Plugin to run SpotBugs on Java and Android project.
This Gradle plugin is designed to solve the following problems in the legacy plugin:
- Remove any dependency on the Gradle's internal API
- Solve mutability problem for the build contains multiple projects and/or sourceSet
- Native Support for the Parallel Build
- Native Support for the Android project
- Missing user document about how to use extension and task
Apply the plugin to your project. Refer the Gradle Plugin portal about the detail of installation procedure.
Configure spotbugs extension to configure the behaviour of tasks:
spotbugs {
ignoreFailures = false
showStackTraces = true
showProgress = true
effort = 'default'
reportLevel = 'default'
visitors = [ 'FindSqlInjection', 'SwitchFallthrough' ]
omitVisitors = [ 'FindNonShortCircuit' ]
reportsDir = file("$buildDir/spotbugs")
includeFilter = file("include.xml")
excludeFilter = file("exclude.xml")
baselineFile = file("baseline.xml")
onlyAnalyze = [ 'com.foobar.MyClass', 'com.foobar.mypkg.*' ]
maxHeapSize = '1g'
extraArgs = [ '-nested:false' ]
jvmArgs = [ '-Duser.language=ja' ]
}with Kotlin DSL
spotbugs {
ignoreFailures.set(false)
showStackTraces.set(true)
showProgress.set(true)
effort.set(com.github.spotbugs.snom.Effort.DEFAULT)
reportLevel.set(com.github.spotbugs.snom.Confidence.DEFAULT)
visitors.set(listOf("FindSqlInjection", "SwitchFallthrough"))
omitVisitors.set(listOf("FindNonShortCircuit"))
reportsDir.set(file("$buildDir/spotbugs"))
includeFilter.set(file("include.xml"))
excludeFilter.set(file("exclude.xml"))
baselineFile.set(file("baseline.xml"))
onlyAnalyze.set(listOf("com.foobar.MyClass", "com.foobar.mypkg.*"))
maxHeapSize.set("1g")
extraArgs.set(listOf("-nested:false"))
jvmArgs.set(listOf("-Duser.language=ja"))
}Configure spotbugsPlugin to apply any SpotBugs plugin:
dependencies {
spotbugsPlugins 'com.h3xstream.findsecbugs:findsecbugs-plugin:1.12.0'
}with Kotlin DSL
dependencies {
spotbugsPlugins("com.h3xstream.findsecbugs:findsecbugs-plugin:1.12.0")
}Configure spotbugs to choose your favorite SpotBugs version:
dependencies {
spotbugs 'com.github.spotbugs:spotbugs:4.7.1'
}with Kotlin DSL
dependencies {
spotbugs("com.github.spotbugs:spotbugs:4.7.1")
}Apply this plugin with the java plugin to your project,
then SpotBugsTask will be generated for each existing sourceSet.
If you want to create and configure SpotBugsTask by own, apply the base plugin (com.github.spotbugs-base) instead, then it won't create tasks automatically.
TBU
Configure SpotBugsTask directly,
to set task-specific properties.
// Example to configure HTML report
spotbugsMain {
reports {
html {
required = true
outputLocation = file("$buildDir/reports/spotbugs/main/spotbugs.html")
stylesheet = 'fancy-hist.xsl'
}
}
}with Kotlin DSL
tasks.spotbugsMain {
reports.create("html") {
required.set(true)
outputLocation.set(file("$buildDir/reports/spotbugs.html"))
setStylesheet("fancy-hist.xsl")
}
}By default, this Gradle Plugin uses the SpotBugs version listed in this table.
You can change SpotBugs version by the toolVersion property of the spotbugs extension or the spotbugs configuration.
| Gradle Plugin | SpotBugs |
|---|---|
| 5.0.9 | 4.7.1 |
| 5.0.7 | 4.7.0 |
| 5.0.4 | 4.5.3 |
| 5.0.3 | 4.5.2 |
| 5.0.2 | 4.5.1 |
| 4.7.10 | 4.5.0 |
| 4.7.8 | 4.4.2 |
| 4.7.5 | 4.4.1 |
| 4.7.3 | 4.4.0 |
| 4.7.2 | 4.3.0 |
| 4.6.1 | 4.2.1 |
| 4.5.0 | 4.1.1 |
| 4.4.4 | 4.0.6 |
| 4.4.2 | 4.0.5 |
| 4.0.7 | 4.0.2 |
| 4.0.0 | 4.0.0 |
From v4, the spotbugs.toolVersion is changed from String to Provider<String>, so use get() or other methods to refer to the actual version.
dependencies {
compileOnly "com.github.spotbugs:spotbugs-annotations:${spotbugs.toolVersion.get()}"
}with Kotlin DSL
dependencies {
compileOnly("com.github.spotbugs:spotbugs-annotations:${spotbugs.toolVersion.get()}")
}- development requires java 11 or higher to be installed
- The CI server uses
ubuntu-latestdocker image, but you should be able to develop on any linux/unix based OS. - before creating commits
- read https://www.conventionalcommits.org/en
- Optionally create the following script in your .git/hooks directory and name it commit.msg. This will ensure that your commits follow the covential commits pattern.
#!/usr/bin/env python
import re, sys, os
#turn off the traceback as it doesn't help readability
sys.tracebacklimit = 0
def main():
# example:
# feat(apikey): added the ability to add api key to configuration
pattern = r'(build|ci|docs|feat|fix|perf|refactor|style|test|chore|revert)(\([\w\-]+\))?:\s.*'
filename = sys.argv[1]
ss = open(filename, 'r').read()
m = re.match(pattern, ss)
if m == None: raise Exception("Conventional commit validation failed. Did you forget to add one of the allowed prefixes? (build|ci|docs|feat|fix|perf|refactor|style|test|chore|revert)")
if __name__ == "__main__":
main()- when running gradle, do so using the
gradlewscript in this directory
Since version 4.3, when we publish artifacts we now sign them. This is designed so that the build will still pass if you don't have the signing keys available, this way pull requests and forked repos will still work as before.
Before github workflow can sign the artifacts generated during build, we first need to generate pgp keys (you will have to do this again when the key expires. once a year is a good timeframe) and upload them to the servers. See https://www.gnupg.org/faq/gnupg-faq.html#starting_out for more details.
That means github needs the following secrets:
SIGNING_KEY = "-----BEGIN PGP PRIVATE KEY BLOCK-----..."
SIGNING_PASSWORD = password
where secrets.SIGNING_KEY is the in-memory ascii-armored keys (you get this by running gpg --armor --export-secret-keys <EMAIL>)
and secrets.SIGNING_PASSWORD is the password you used when generating the key.
Gradle is configured to use these to generate the private key in memory so as to minimize our risk of the keys being found and used by someone else.
Copyright © 2019-present SpotBugs Team