Newly Organized SpotBugs Gradle Plugin

This is the official Gradle Plugin to run SpotBugs on Java and Android project.

Goal

This Gradle plugin is designed to solve the following problems in the legacy plugin:

Remove any dependency on the Gradle's internal API
Solve mutability problem for the build contains multiple projects and/or sourceSet
Native Support for the Parallel Build
Native Support for the Android project
Missing user document about how to use extension and task

Usage

Apply to your project

Apply the plugin to your project. Refer the Gradle Plugin portal about the detail of installation procedure.

Configure SpotBugs Plugin

Configure spotbugs extension to configure the behaviour of tasks:

spotbugs {
    ignoreFailures = false
    showProgress = true
    effort = 'default'
    reportLevel = 'default'
    visitors = [ 'FindSqlInjection', 'SwitchFallthrough' ]
    omitVisitors = [ 'FindNonShortCircuit' ]
    reportsDir = file("$buildDir/spotbugs")
    includeFilter = file("include.xml")
    excludeFilter = file("exclude.xml")
    onlyAnalyze = [ 'com.foobar.MyClass', 'com.foobar.mypkg.*' ]
    maxHeapSize = '1g'
    extraArgs = [ '-nested:false' ]
    jvmArgs = [ '-Duser.language=ja' ]
}

Configure spotbugsPlugin to apply any SpotBugs plugin:

dependencies {
    spotbugsPlugins 'com.h3xstream.findsecbugs:findsecbugs-plugin:1.7.1'
}

Configure spotbugs to choose your favorite SpotBugs version:

dependencies {
    spotbugs 'com.github.spotbugs:spotbugs:4.0.0'
}

Apply to Java project

Apply this plugin with the java plugin to your project, then SpotBugsTask will be generated for each existing sourceSet.

If you want to create and configure SpotBugsTask by own, apply the base plugin (com.github.spotbugs-base) instead, then it won't create tasks automatically.

Apply to Android project

TBU

Configure the SpotBugsTask

Configure SpotBugsTask directly, to set task-specific properties.

// Example to configure HTML report
spotbugsMain {
    reports {
        html {
            enabled = true
            destination = file("$buildDir/reports/spotbugs/main/spotbugs.html")
            stylesheet = 'fancy-hist.xsl'
        }
    }
}

SpotBugs version mapping

By default, this Gradle Plugin uses the SpotBugs version listed in this table.

You can change SpotBugs version by the toolVersion property of the spotbugs extension or the spotbugs configuration.

Gradle Plugin	SpotBugs
4.0.7	4.0.2
4.0.0	4.0.0

Refer the version in the build script

From v4, the spotbugs.toolVersion is changed from String to Provider<String>, so use get() or other methods to refer to the actual version.

dependencies {
    compileOnly "com.github.spotbugs:spotbugs-annotations:${spotbugs.toolVersion.get()}"
}

davidburstromspotify / spotbugs-gradle-plugin