spotbugs configuration in gradle build not working correctly (full build throws error while individual subproject runs without any output for spotbugs

Question

I have been trying to run spotbugs plugin on my projects using a global build.gradle setup. The plugin is added and seems that build is running. Build and spotbugsMain both are successful when I run them using

./gradlew :com.myproject.something:build --stacktrace

./gradlew :com.myproject.something:spotbugsMain --stracktrace

But if I understand it correctly, it should generate a report (in spotbugs folder?) under build-gradle folder.

I do not see anything generated. spotbugs folder itself is not showing up.

Here is my build.gradle. Can someone please tell me what I am doing wrong? I am not sure I understand concepts of gradle completely but I have tried to use other references.

Minimal working SpotBugs setup for Android Studio

 plugins {
        id "com.github.spotbugs" version "4.7.2" apply false
    }

    group = 'com.myproject'

    subprojects {
        apply plugin: 'java-library'
        apply plugin: 'maven-publish'
        apply plugin: 'com.github.spotbugs'

        buildDir = 'build-gradle'
        
        spotbugs {
          toolVersion = '4.3.0'
          ignoreFailures = false
          showStackTraces = true
          showProgress = true
          effort = 'max'
          reportLevel = 'high'
          maxHeapSize = '1g'
          reportsDir = file("$buildDir/spotbugs")
        }
        
        tasks.withType(com.github.spotbugs.snom.SpotBugsTask) {
                group 'Verification'
                description 'Run Spotbugs on this project.'
                dependsOn 'assemble'
              reports {
                    xml.enabled = false
                    html.enabled = true
                }
                classDirs = files('$buildDir.absolutePath/build-gradle/classes/java/main')
                sourceDirs = files('$buildDir.absolutePath/src/main/java')
        }

        repositories {
            // the order here is important. Repositories are queried in the exact order specified here
            mavenLocal()
            mavenCentral()
            
            maven {
                url = uri('http://build.myproject.com:8081/nexus/content/repositories/snapshots')
                allowInsecureProtocol = true
            }

            maven {
                url = uri('http://build.myproject.com:8081/nexus/content/repositories/releases')
                allowInsecureProtocol = true
            }

            maven {
                url = uri('http://build.myproject.com:8081/nexus/content/repositories/myproject')
                allowInsecureProtocol = true
            }

            maven {
                url = uri('http://build.myproject.com:8081/nexus/content/repositories/thirdparty')
                allowInsecureProtocol = true
            }
        }
        
        publishing {
            publications {
                maven(MavenPublication) {
                    from(components.java)
                }
            }
        }

        test {
            filter {
                excludeTestsMatching "*IT"
                environment 'RESOURCES_PATH', 'build-gradle/resources/test'
            }
        }

        tasks.withType(JavaCompile) {
            options.encoding = 'UTF-8'
        }
    }

UPDATE : 07/26/2021

I tried to run full build including all the subprojects instead of individual subproject as mentioned above. I used command

./gradlew clean build --stacktrace

This time, it did not work! The full build is throwing an error as below.

Task :com.vmturbo.mediation.applicationserver.jboss:compileJava FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':com.myproject.something:compileJava'.
Could not resolve all files for configuration ':com.myproject.something:compileClasspath'.
   Could not find com.github.spotbugs:spotbugs-annotations:4.7.2.
     Searched in the following locations:
       - file:/Users/myuser/.m2/repository/com/github/spotbugs/spotbugs-annotations/4.7.2/spotbugs-annotations-4.7.2.pom
       - https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs-annotations/4.7.2/spotbugs-annotations-4.7.2.pom
       - http://build.myproject.com:8081/nexus/content/repositories/snapshots/com/github/spotbugs/spotbugs-annotations/4.7.2/spotbugs-annotations-4.7.2.pom
       - http://build.myproject.com:8081/nexus/content/repositories/releases/com/github/spotbugs/spotbugs-annotations/4.7.2/spotbugs-annotations-4.7.2.pom
       - http://build.myproject.com:8081/nexus/content/repositories/myproject/com/github/spotbugs/spotbugs-annotations/4.7.2/spotbugs-annotations-4.7.2.pom
       - http://build.myproject.com:8081/nexus/content/repositories/thirdparty/com/github/spotbugs/spotbugs-annotations/4.7.2/spotbugs-annotations-4.7.2.pom
     Required by:
         project :com.myproject.something

Any idea about the problem? It seems full build does not work with above error and if I try to build only 1 subproject com.myproject.something then it runs fine but does not generate anything related to spotbugs.

Answer 1

In your project level build.gradle

plugins {
    id 'com.github.spotbugs' version '5.0.14' apply false
}

subprojects {
    //spot bugs reports generated only this way
    apply plugin: 'com.github.spotbugs'
    spotbugs {
        toolVersion = '4.2.3'
    }

    tasks.withType(SpotBugsTask) {
        reports {
            xml.enabled = false
            html.enabled = true
        }
    }
}

Now, to run SpotBugsTask and generate report on your ${projectDir}/build/report/spotbugs, we have to run ./gradlew check

Answer 2

You can refer to this answer: Minimal working SpotBugs setup for Android Studio.

Following which I let my android project run successfully and got the spotbugs check report. The report will be generated in path of {module_name}/build/spotbugsReports/main.html. The running command can be ./gradlew build or ./gradlew spotbugsMain.

In build.gradle of app module:

apply plugin: 'com.github.spotbugs' // <- Add this

spotbugs {
    toolVersion = "3.1.3"
    ignoreFailures = false
    showProgress = true
    reportsDir = file("$project.buildDir/spotbugsReports")
    effort = "max"
    reportLevel = "high"
}

tasks.withType(com.github.spotbugs.SpotBugsTask) {
    group 'Verification'
    description 'Run Spotbugs on this project.'
    // You'll also need to enable the HTML report and disable XML report, to see a human-readable format.
    reports {
        xml.enabled = false
        html.enabled = true
    }
    dependsOn 'assemble'
    classes = files("$projectDir.absolutePath/build/intermediates/javac")
    source = fileTree('src/main/java') // Only needed on gradle 4/5
}

// This block is only needed for gradle 4/5 only.
// It's for SpotBugs to create a 'spotbugsMain' gradle task.
sourceSets {
    main {
        java.srcDirs = []
    }
}

android {
...
}

dependencies {
...
}

In build.gradle of root project:

buildscript {
    repositories {
    ...
    }
    dependencies {
        classpath 'com.android.tools.build:gradle:3.2.1'
        classpath 'gradle.plugin.com.github.spotbugs:spotbugs-gradle-plugin:1.6.6'
    }
}

allprojects {
    repositories {
    ...
    }
}

The Gradle Wrapper Version of my project is gradle-4.10.1-all.zip. Pay attention that when you'are using Gradle v4 - lastest Spotbugs version you could use only 1.6.6. Ref: https://gist.github.com/mik9/fdde79052fef7f03c4325734701a39d7

Answer 3

I found the problem. I am not entirely sure why though. This thread helped.

https://github.com/spotbugs/spotbugs/issues/1027

In my build.gradle I was using this block ->

tasks.withType(com.github.spotbugs.snom.SpotBugsTask) {
        group 'Verification'
        description 'Run Spotbugs on this project.'
        dependsOn 'assemble'
        reports {
           xml.enabled = false
           html.enabled = true
        }
        classDirs = files('$buildDir.absolutePath/build-gradle/classes/java/main')
        sourceDirs = files('$buildDir.absolutePath/src/main/java')
}

But instead when I changed that to this, all seemed to work and spotbugs folder and under it, report got generated. Apparently, I did not need to provide class and source folders at all.

spotbugsMain {
    reports {
        xml.enabled = false
        html.enabled = true
    }
}

spotbugsTest {
    reports {
        xml.enabled = false
        html.enabled = true
    }
}

FINAL build.gradle file

plugins {
    id "com.github.spotbugs" version "4.7.2" apply false
}

group = 'com.myproject'

subprojects {
    apply plugin: 'java-library'
    apply plugin: 'maven-publish'
    apply plugin: 'com.github.spotbugs'

    buildDir = 'build-gradle'
    
    spotbugs {
      toolVersion = '4.3.0'
      ignoreFailures = false
      showStackTraces = true
      showProgress = true
      effort = 'max'
      reportLevel = 'high'
      maxHeapSize = '1g'
      reportsDir = file("$buildDir/spotbugs")
    }
    
    spotbugsMain {
        reports {
            xml.enabled = false
            html.enabled = true
        }
    }

    spotbugsTest {
        reports {
            xml.enabled = false
            html.enabled = true
        }
    }

    repositories {
        // the order here is important. Repositories are queried in the exact order specified here
        mavenLocal()
        mavenCentral()
        
        maven {
            url = uri('http://build.myproject.com:8081/nexus/content/repositories/snapshots')
            allowInsecureProtocol = true
        }

        maven {
            url = uri('http://build.myproject.com:8081/nexus/content/repositories/releases')
            allowInsecureProtocol = true
        }

        maven {
            url = uri('http://build.myproject.com:8081/nexus/content/repositories/myproject')
            allowInsecureProtocol = true
        }

        maven {
            url = uri('http://build.myproject.com:8081/nexus/content/repositories/thirdparty')
            allowInsecureProtocol = true
        }
    }
    
    publishing {
        publications {
            maven(MavenPublication) {
                from(components.java)
            }
        }
    }

    test {
        filter {
            excludeTestsMatching "*IT"
            environment 'RESOURCES_PATH', 'build-gradle/resources/test'
        }
    }

    tasks.withType(JavaCompile) {
        options.encoding = 'UTF-8'
    }
}

Ran these commands and they succeeded - meaning that I got spotbugs errors in code and build failed! which is what I was looking for!

./gradlew check and ./gradlew clean build --stacktrace

7 SpotBugs violations were found. See the report at: file:///Users/myuser/com.myproject.something/build-gradle/spotbugs/test.html