Add more spotbugs checks

Add more thorough spotbugs checks

The Jenkins plugin pom enables static analysis with spotbugs. Plugin maintenance can be improved in some cases by increasing the depth of spotbugs analysis.

Create a branch

Create a git branch for your local work with the command:

$ git checkout -b add-spotbugs-checks master

Increase spotbugs checks

To increase the spotbugs analysis checks, add the spotbugs properties entries in the properties section of the pom.xml file:

   <properties>
     <spotbugs.effort>Max</spotbugs.effort>
     <spotbugs.threshold>Low</spotbugs.threshold>
   </properties>

Review and fix spotbugs warnings

When the spotbugs analysis checks are increased, they often report new issues that need to be resolved or suppressed. Spotbugs checks are included in the Apache Maven verify step. Run the spotbugs analysis checks as part of the Apache Maven verify step with the command:

$ mvn clean -DskipTests verify

It is generally preferred to fix a spotbugs warning rather than suppress the warning message. However, in those cases where a spotbugs message is incorrect or is infeasible to fix, it can be suppressed with the SuppressFBWarnings annotation. A suppression might look like this:

import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
/* ... preceding a method that returns a Boolean and may return null */
    @SuppressFBWarnings(
            value = "NP_BOOLEAN_RETURN_NULL",
            justification = "Null return indicates others should evaluate further")

Add a spotbugs exclusions file (if needed)

Sometimes the number of spotbugs exclusions make it inconenient or tedious to place the exclusions in the source files. In those cases, a spotbugs exclusions file can be used to list the spotbugs warnings that are being excluded and the classes, methods, and fields involved.

A good example of the spotbugs exclusions file and its configuration is available from Jenkins core. See the src/spotbugs/spotbugs-excludes.xml source file for examples. See the pom.xml file for the property that enables the spotbugs excludeFilterFile.

An example excludes filter file is also included here:

<?xml version="1.0" encoding="UTF-8"?>
<FindBugsFilter>
  <!--
    Exclusions in this section have been triaged and determined to be false positives.
  -->

  <!--
    Here lies technical debt. Exclusions in this section have not yet been triaged. When working on
    on this section, pick an exclusion to triage, then:
    - If it is a false positive, add a @SuppressFBWarnings(value = "[...]", justification = "[...]")
      annotation indicating the reason why it is a false positive, then remove the exclusion from
      this section.
    - If it is not a false positive, fix the bug, then remove the exclusion from this section.
   -->
  <Match>
    <Or>
      <And>
        <Bug pattern="ES_COMPARING_PARAMETER_STRING_WITH_EQ"/>
        <Class name="com.orctom.jenkins.plugin.buildtimestamp.ShiftExpressionHelper"/>
      </And>
      <And>
        <Bug pattern="DM_BOXED_PRIMITIVE_FOR_PARSING"/>
        <Class name="com.orctom.jenkins.plugin.buildtimestamp.ShiftExpressionHelper"/>
      </And>
    </Or>
  </Match>
</FindBugsFilter>

Create a pull request

Commit that change:

$ git add pom.xml src/spotbugs
$ git commit -m "Increase spotbugs effort and threshold"

Push the change to GitHub:

$ git push origin --set-upstream add-spotbugs-checks
Total 0 (delta 0), reused 0 (delta 0), pack-reused 0
remote:
remote: Create a pull request for 'add-spotbugs-checks' on GitHub by visiting:
remote: https://github.com/user/your-plugin/pull/new/add-spotbugs-checks
remote:
To github.com:user/your-plugin.git
 * [new branch]      add-spotbugs-checks -> add-spotbugs-checks
Branch 'add-spotbugs-checks' tracking remote branch 'add-spotbugs-checks'.

Notice that the output of the command includes the URL, which can be used to open a pull request. Copy that URL in your web browser and submit a pull request.

Topics

How-To Guides

Resources

Extensions Index

Javadoc

Taglibs

Tools