Add Spotbugs (#5)

* Add support for running spotbugs
* Add spotbugs check to validate workflow

.github/workflows/validate.yml

@@ -58,4 +58,16 @@ jobs:
       - name: Maven build
         run: |
           mvn -B -e $MAVEN_HTTP_ARGS clean install
-
+  spotbugs:
+    timeout-minutes: 10
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up JDK ${{ env.JAVA_VERSION }}
+        uses: actions/[email protected]
+        with:
+          distribution: ${{ env.JAVA_DISTRO }}
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: maven
+      - name: Spotbugs
+        run: etc/scripts/spotbugs.sh

etc/scripts/spotbugs.sh

@@ -0,0 +1,47 @@
+#!/bin/bash -e
+#
+# Copyright (c) 2024 Oracle and/or its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+set -o pipefail || true  # trace ERR through pipes
+set -o errtrace || true # trace ERR through commands and functions
+set -o errexit || true  # exit the script if any statement returns a non-true return value
+
+on_error(){
+    CODE="${?}" && \
+    set +x && \
+    printf "[ERROR] Error(code=%s) occurred at %s:%s command: %s\n" \
+        "${CODE}" "${BASH_SOURCE[0]}" "${LINENO}" "${BASH_COMMAND}"
+}
+trap on_error ERR
+
+# Path to this script
+if [ -h "${0}" ] ; then
+    SCRIPT_PATH="$(readlink "${0}")"
+else
+    SCRIPT_PATH="${0}"
+fi
+readonly SCRIPT_PATH
+
+# Path to the root of the workspace
+# shellcheck disable=SC2046
+WS_DIR=$(cd $(dirname -- "${SCRIPT_PATH}") ; cd ../.. ; pwd -P)
+readonly WS_DIR
+
+mvn ${MAVEN_ARGS} -f ${WS_DIR}/pom.xml \
+    install -e \
+    -DskipTests \
+    -Dmaven.test.skip=true \
+    -Pspotbugs

etc/spotbugs/exclude.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Copyright (c) 2024 Oracle and/or its affiliates.
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+
+-->
+
+<FindBugsFilter
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xmlns="https://github.com/spotbugs/filter/3.0.0"
+        xsi:schemaLocation="https://github.com/spotbugs/filter/3.0.0 https://raw.githubusercontent.com/spotbugs/spotbugs/3.1.0/spotbugs/etc/findbugsfilter.xsd">
+
+
+</FindBugsFilter>

pom.xml

@@ -37,6 +37,9 @@
 
         <checkstyle.skip>false</checkstyle.skip>
         <dependency-check.skip>false</dependency-check.skip>
+        <spotbugs.skip>false</spotbugs.skip>
+        <spotbugs.threshold>Medium</spotbugs.threshold>
+        <spotbugs.exclude>etc/spotbugs/exclude.xml</spotbugs.exclude>
 
         <version.lib.checkstyle>10.13.0</version.lib.checkstyle>
         <version.lib.hsqldb>2.7.2</version.lib.hsqldb>
@@ -50,7 +53,8 @@
         <version.plugin.helidon-build-tools>4.0.6</version.plugin.helidon-build-tools>
         <version.plugin.jandex-maven-plugin>3.1.7</version.plugin.jandex-maven-plugin>
         <version.plugin.openapi-generator>6.2.1</version.plugin.openapi-generator>
-
+        <version.plugin.spotbugs>4.8.5.0</version.plugin.spotbugs>
+        <version.plugin.findsecbugs>1.13.0</version.plugin.findsecbugs>
     </properties>
 
     <dependencies>
@@ -389,6 +393,26 @@
                     </typosConfig>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>com.github.spotbugs</groupId>
+                <artifactId>spotbugs-maven-plugin</artifactId>
+                <version>${version.plugin.spotbugs}</version>
+                <configuration>
+                    <omitVisitors>FindReturnRef</omitVisitors>
+                    <skip>${spotbugs.skip}</skip>
+                    <threshold>${spotbugs.threshold}</threshold>
+                    <!--suppress UnresolvedMavenProperty -->
+                    <excludeFilterFile>${spotbugs.exclude}</excludeFilterFile>
+                    <xmlOutput>true</xmlOutput>
+                    <plugins>
+                        <plugin>
+                            <groupId>com.h3xstream.findsecbugs</groupId>
+                            <artifactId>findsecbugs-plugin</artifactId>
+                            <version>${version.plugin.findsecbugs}</version>
+                        </plugin>
+                    </plugins>
+                </configuration>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-checkstyle-plugin</artifactId>
@@ -436,5 +460,23 @@
                 </plugins>
             </build>
         </profile>
+        <profile>
+            <id>spotbugs</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>com.github.spotbugs</groupId>
+                        <artifactId>spotbugs-maven-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <goals>
+                                    <goal>check</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
     </profiles>
 </project>