Unable to run spotbugs 4.0.0 in build

[lowecg]

In spotbugs-maven-plugin 3.1.12 we can run spotbugs as part of our build and break it if any violations are encountered:

    <build>
        <plugins>
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>3.1.12.2</version>
                <executions>
                    <execution>
                        <id>analyze-compile</id>
                        <phase>compile</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

If I change the version to 4.0.0, the build fails with the following:

[ERROR] Failed to execute goal com.github.spotbugs:spotbugs-maven-plugin:4.0.0:spotbugs (spotbugs) on project xxxx: Execution spotbugs of goal com.github.spotbugs:spotbugs-maven-plugin:4.0.0:spotbugs failed: An API incompatibility was encountered while executing com.github.spotbugs:spotbugs-maven-plugin:4.0.0:spotbugs: java.lang.IllegalAccessError: tried to access method org.codehaus.mojo.spotbugs.SpotBugsMojo.executeSpotbugs(Ljava/io/File;)V from class org.codehaus.mojo.spotbugs.SpotBugsMojo$executeSpotbugs

Full error info (with stacktrace) from a run with mvn clean install -DskipTests -DskipITs -e -X is included:

spotbugs_build_error.txt

If I omit the execution config, then the spotbugs plugin is not invoked at all.

[hazendaz]

@lowecg I'm not able to duplicate this. I do see that you are trying to use spotbugs 4.0.1 instead of 4.0.0 as this plugin shipped. Can you please change back to 4.0.0 on spotbugs and see if the issue persists?

[lowecg]

@hazendaz thanks for looking into this. I've tried with sb 4.0.0 as requested and see the same result (see attached).

log.txt

[lowecg]

I've created a simple project that reproduces the issue for me:

https://github.com/lowecg/spotbugs-repro-issue212

mvn clean install -e -X > log.txt log.txt

I removed my local ~/.m2/settings and ~/.m2/repository prior to the above execution.

[hazendaz]

@lowecg Thanks for the sample. It works for me without issue. I'm using Oracle Jdks or Open Jdks on travis CI. I notice you have a different jdk. I downloaded corretto and again no issue. Are you sure you don't have groovy somewhere else on your path that is not 3.0.0 or better? The issue you are experiencing is groovy and this maven plugin is entirely groovy on latest release. So it's possible you have earlier version that is being picked up somewhere and causing issues. Although I don't see that from the general output provided.

[lowecg]

Thanks again for trying to recreate the issue and providing feedback.

I managed to get the build working. My local environment had the following option (amongst others) from an experiment to improve build speeds (dev only!). If I unset this, then the build works. If I set it back then it breaks as before.

export MAVEN_OPTS="-Xverify:none"

Clearly we have no desire to make spotbugs work with this configuration, and dropping this option is the solution! The "-Xverify" option will be gone from the JDK soon any way, and was deprecated in JDK 13.

Thanks for your help, @hazendaz