Generate report file from analysis.

typetools / checker-framework

Pluggable type-checking for Java

http://checkerframework.org/

Other

1.02k stars 354 forks source link

Open Vyom-Yadav opened 1 year ago

Vyom-Yadav commented 1 year ago

Currently, Checker Framework outputs all the warnings and errors to the console.

When using a build system like maven or gradle, the order of output can vary (see known bug with maven).

Checker Framework should generate a parsable report file which can be easily extended to create universal suppression systems, etc.

Currently, at Checkstyle, we use a custom suppression model built with groovy, which parses the output and checks the .xml suppression file.

msridhar commented 1 year ago

If / when someone has cycles to work on this, this Error Prone issue / discussion might be relevant:

In particular @tbroyer prototyped a relatively non-intrusive way to serialize Error Prone warnings:

A similar approach may work here.

mernst commented 1 year ago

I was thinking of just defining a new subclass of Messager, which could be done within the Checker Framework.

mernst commented 4 months ago

A few notes for anyone who wants to take up this project:

The SARIF output format is the best choice.
There are Java bindings in Maven Central; see https://github.com/Contrast-Security-OSS/java-sarif
It would be better for SARIF to be supported by the build tool or by javac, but an implementation in the Checker Framework would fill the gap until that time comes.