search

spotbugs / spotbugs-maven-plugin

Maven Mojo Plug-In to generate reports based on the SpotBugs Analyzer
https://spotbugs.github.io/spotbugs-maven-plugin/
Apache License 2.0
69 stars 51 forks source link

mvn clean spotbugs:check give no errors as it runs on classes, so add a warning to users that miss compile #75

Open romani opened 5 years ago

romani commented 5 years ago

steps:

$ git clone git@github.com:checkstyle/checkstyle.git 
$ cd checkstyle
$ mvn clean spotbugs:check
[INFO] Scanning for projects...
[INFO] Inspecting build with total of 1 modules...
[INFO] Installing Nexus Staging features:
[INFO]   ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin
[INFO]                                                                         
[INFO] ------------------------------------------------------------------------
[INFO] Building checkstyle 8.13-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- maven-clean-plugin:3.1.0:clean (default-clean) @ checkstyle ---
[INFO] Deleting /home/rivanov/java/github/checkstyle/checkstyle/target
[INFO] 
[INFO] >>> spotbugs-maven-plugin:3.1.6:check (default-cli) > :spotbugs @ checkstyle >>>
[INFO] 
[INFO] --- spotbugs-maven-plugin:3.1.6:spotbugs (spotbugs) @ checkstyle ---
[INFO] 
[INFO] <<< spotbugs-maven-plugin:3.1.6:check (default-cli) < :spotbugs @ checkstyle <<<
[INFO] 
[INFO] --- spotbugs-maven-plugin:3.1.6:check (default-cli) @ checkstyle ---
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.783 s
[INFO] Finished at: 2018-08-30T16:44:18-07:00
[INFO] Final Memory: 28M/397M
[INFO] ------------------------------------------------------------------------
hazendaz commented 5 years ago

@romani I'd like to see the plugin run with overridden dependency 3.1.5 to vet the issue is the plugin or with spotbugs itself. Given the stack trace, it would seem it is with spotbugs rather than the plugin.

romani commented 5 years ago

to confirm, do you want to see log of build when it was 3.1.5 ? I tried to open issue on library itself but requires precise test case to reproduce ... not sure how to make it.

version definition : https://github.com/checkstyle/checkstyle/blob/master/pom.xml#L204

here is log on 3.1.5 - https://travis-ci.org/checkstyle/checkstyle/jobs/412242219#L758

hazendaz commented 5 years ago

Still use 3.1.6 plugin, add dependencies section for spotbugs 3.1.5. That way it downgrades spotbugs but otherwise runs plugin as is. I believe the issue is with spotbugs not this plugin and that will prove the theory and help get the issue over to code spotbugs team.

Get Outlook for Androidhttps://aka.ms/ghei36

From: Roman Ivanov notifications@github.com Sent: Wednesday, September 5, 2018 9:08:29 AM To: spotbugs/spotbugs-maven-plugin Cc: Jeremy Landis; Comment Subject: Re: [spotbugs/spotbugs-maven-plugin] mvn clean spotbugs:check give not errors (#75)

to confirm, do you want to see log of build when it was 3.1.5 ? I tried to open issue on library itself but requires precise test case to reproduce ... not sure how to make it.

version definition : https://github.com/checkstyle/checkstyle/blob/master/pom.xml#L204

here is log on 3.1.5 - https://travis-ci.org/checkstyle/checkstyle/jobs/412242219#L758

— You are receiving this because you commented. Reply to this email directly, view it on GitHubhttps://github.com/spotbugs/spotbugs-maven-plugin/issues/75#issuecomment-418723965, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AA7ho4NpoW5Qd-XBncS6rEpYbVUym4mWks5uX8zNgaJpZM4WUY0N.

crizzis commented 5 years ago

Isn't this the expected behavior? SpotBugs operates on bytecode, and so it requires compiled classes. Doesn't mvn clean compile spotbugs:check fix the problem for you?

romani commented 5 years ago

yes, adding compile works. But should be there some warning or error ? that no bite code is found, validation is skipped.

crizzis commented 5 years ago

I agree that a warning would not be unreasonable in such a scenario. It would also be great if the requirement of compiled classes was made clear in the plugin docs

romani commented 5 years ago

Maybe extra property to fail if no binaries are found, in case config of compiler and spotbugs is unsynched.