[I] Stabilize SpotBugs task wiring and detector execution [grails-core]

["jamesfredley (via GitHub)" <gi...@apache.org>]

jamesfredley opened a new issue, #16014:
URL: https://github.com/apache/grails-core/issues/16014

   ## Summary
   
   SpotBugs cannot currently be enabled reliably across the root build. A broad analysis run exposes two independent infrastructure failures before existing findings can be made blocking:
   
   1. Gradle 9 task validation reports implicit task dependencies where SpotBugs consumes generated outputs, including `compileGsonViews`, without a declared dependency.
   2. SpotBugs detector execution throws `IndexOutOfBoundsException` while analyzing some Grails-generated/controller bytecode.
   
   These are execution/tooling failures, separate from the reported bug backlog.
   
   ## Reproduction
   
   ```shell
   ./gradlew aggregateAnalysisViolations --continue \
     -Pgrails.code-analysis.enabled.spotbugs=true \
     -Pgrails.code-analysis.ignoreFailures=true
   ```
   
   ## Observed behavior
   
   - Gradle fails task validation for undeclared producer/consumer relationships involving generated Gson views.
   - SpotBugs logs detector `IndexOutOfBoundsException` failures for generated/controller classes.
   - The aggregate build does not complete reliably, even though many module XML reports are written.
   
   ## Suggested approach
   
   - Model generated bytecode/source directories with explicit task dependencies or exclude outputs that SpotBugs must not analyze.
   - Capture the detector name and smallest failing class from a single-module run.
   - Verify whether the failure is fixed by a SpotBugs/plugin update; otherwise add the narrowest detector or generated-class exclusion with an upstream issue reference.
   - Keep SpotBugs disabled in blocking CI until the broad run exits successfully.
   
   ## Acceptance criteria
   
   - The reproduction command exits successfully without Gradle task-validation errors.
   - No detector crashes or analysis exceptions appear in the logs.
   - Every source-bearing module either emits a valid XML report or is explicitly and justifiably excluded.
   - Any detector exclusion links to an upstream issue and a minimal reproducer.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Stabilize SpotBugs task wiring and detector execution [grails-core]

["jdaugherty (via GitHub)" <gi...@apache.org>]

jdaugherty closed issue #16014: Stabilize SpotBugs task wiring and detector execution
URL: https://github.com/apache/grails-core/issues/16014


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org