https://github.com/spotbugs/spotbugs

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
https://github.com/spotbugs/spotbugs

code-analysis findbugs hacktoberfest linter static-analysis static-code-analysis

Last synced: 3 days ago
JSON representation

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

• Host: GitHub
• URL: https://github.com/spotbugs/spotbugs
• Owner: spotbugs
• License: lgpl-2.1
• Created: 2016-11-04T22:18:08.000Z (about 8 years ago)
• Default Branch: master
• Last Pushed: 2024-10-26T16:08:32.000Z (about 2 months ago)
• Last Synced: 2024-10-29T15:05:08.500Z (about 1 month ago)
• Topics: code-analysis, findbugs, hacktoberfest, linter, static-analysis, static-code-analysis
• Language: Java
• Homepage: https://spotbugs.github.io/
• Size: 139 MB
• Stars: 3,489
• Watchers: 76
• Forks: 588
• Open Issues: 438
• Metadata Files:
  • Readme: README.md
  • Changelog: CHANGELOG.md
  • Contributing: .github/CONTRIBUTING.md
  • License: LICENSE
  • Governance: GOVERNANCE.md

Awesome Lists containing this project

• awesome-java - Spotbugs - Static analysis of bytecode to find potential bugs. (LGPL-2.1-only) (Projects / Code Analysis)
• awesome-java - spotbugs
• awesome-devsecops - SpotBugs - _SpotBugs_ - Static code analysis for Java applications. (Tools / Static Analysis)
• awesome-java-zh - Spotbugs - 字节码的静态分析，以发现潜在的错误。(LGPL-2.1-only) (项目 / 代码分析)
• awesome-java-security - Spotbugs - SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code. (Static Code Analysis)
• awesome-java - Spotbugs - Static analysis of bytecode to find potential bugs. (LGPL-2.1-only) (Projects / Code Analysis)
• awesome-software-supply-chain-security - SpotBugs -  - SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code. (Static Application Security Testing)

README

        

# ![SpotBugs](https://spotbugs.github.io/images/logos/spotbugs_logo_300px.png)

[![Build Status](https://github.com/spotbugs/spotbugs/workflows/build/badge.svg)](https://github.com/spotbugs/spotbugs/actions)

[![Documentation Status](https://readthedocs.org/projects/spotbugs/badge/?version=latest)](https://spotbugs.readthedocs.io/en/latest/?badge=latest)

[![Coverage Status](https://sonarcloud.io/api/project_badges/measure?branch=master&project=com.github.spotbugs.spotbugs&metric=coverage)](https://sonarcloud.io/component_measures?id=com.github.spotbugs.spotbugs&metric=coverage)

[![Maven Central](https://maven-badges.herokuapp.com/maven-central/com.github.spotbugs/spotbugs/badge.svg)](https://maven-badges.herokuapp.com/maven-central/com.github.spotbugs/spotbugs)

[![Javadocs](https://javadoc.io/badge/com.github.spotbugs/spotbugs.svg)](https://javadoc.io/doc/com.github.spotbugs/spotbugs)

[SpotBugs](https://spotbugs.github.io/) is the spiritual successor of [FindBugs](https://github.com/findbugsproject/findbugs), carrying on from the point where it left off with support of its community.

SpotBugs is licensed under the [GNU LESSER GENERAL PUBLIC LICENSE](https://github.com/spotbugs/spotbugs/blob/master/spotbugs/licenses/LICENSE.txt).

More information at the [official website](https://spotbugs.github.io/). A lot of things can still be found at the [old FindBugs website](https://findbugs.sourceforge.net).

# Build

SpotBugs is built using [Gradle](https://gradle.org). The recommended way to obtain it is to simply run the `gradlew` (or `gradlew.bat`) wrapper, which will automatically download and run the correct version as needed (using the settings in `gradle/wrapper/gradle-wrapper.properties`).

Building SpotBugs requires JDK 21 to run all the tests (using SpotBugs requires JDK 11 or above, but it can analyze code compiled with older versions).

To see a list of build options, run `gradle tasks` (or `gradlew tasks`). The `build` task will perform a full build and test.

To build the SpotBugs plugin for Eclipse, you'll need to create the file `eclipsePlugin/local.properties`, containing a property `eclipseRoot.dir` that points to an Eclipse installation's root directory (see `.github/workflows/release.yml` for an example), then run the build.

To prepare Eclipse environment only, run `./gradlew eclipse`. See also [detailed steps](https://github.com/spotbugs/spotbugs/blob/master/eclipsePlugin/doc/building_spotbugs_plugin.txt).

# Using SpotBugs

SpotBugs can be used standalone and through several integrations, including:

* [Ant](https://spotbugs.readthedocs.io/en/latest/ant.html)

* [Maven](https://spotbugs.readthedocs.io/en/latest/maven.html)

* [Gradle](https://spotbugs.readthedocs.io/en/latest/gradle.html)

* [Eclipse](https://spotbugs.readthedocs.io/en/latest/eclipse.html)

* [Sonarqube](https://github.com/spotbugs/sonar-findbugs)

* [IntelliJ IDEA](https://github.com/JetBrains/spotbugs-intellij-plugin)

# Questions?

You can contact us using [GitHub Discussions](https://github.com/spotbugs/spotbugs/discussions).