Merge branch 'gh74_findbugs'

Scan sources by FindBugs.

Fix #74

Author: php-coder

pom.xml

@@ -393,6 +393,8 @@
 		<enforcer.plugin.version>1.4.1</enforcer.plugin.version>
 		<failsafe.plugin.version>2.19.1</failsafe.plugin.version>
 		<fest.assert.version>2.0M8</fest.assert.version>
+		<findbugs.excludeFilterFile>src/main/config/findbugs-filter.xml</findbugs.excludeFilterFile>
+		<findbugs.plugin.version>3.0.4</findbugs.plugin.version>
 		<gmaven.plugin.version>1.4</gmaven.plugin.version>
 		<gmaven.runtime.plugin.version>1.5</gmaven.runtime.plugin.version>
 
@@ -756,6 +758,19 @@
 				</configuration>
 			</plugin>
 
+			<!--
+			     Usage:
+			     mvn findbugs:check (checks the sources and produces report to the console)
+			-->
+			<plugin>
+				<groupId>org.codehaus.gmaven</groupId>
+				<artifactId>findbugs-maven-plugin</artifactId>
+				<version>${findbugs.plugin.version}</version>
+				<configuration>
+					<includeTests>true</includeTests>
+				</configuration>
+			</plugin>
+			
 			<plugin>
 				<groupId>org.codehaus.gmaven</groupId>
 				<artifactId>gmaven-plugin</artifactId>

src/main/config/findbugs-filter.xml

@@ -0,0 +1,18 @@
+<FindBugsFilter>
+	<Match>
+		<!--
+			Our DTO classes expose it's internal representation.
+			Most of the time because they're using Date class and
+			storing data in byte[].
+		-->
+		<Class name="~.*\.dto\..*" />
+		<Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2" />
+	</Match>
+	<Match>
+		<!--
+			It's ok, that we're don't override parent's equals() method.
+		-->
+		<Class name="ru.mystamps.web.support.spring.security.CustomUserDetails" />
+		<Bug pattern="EQ_DOESNT_OVERRIDE_EQUALS" />
+	</Match>
+</FindBugsFilter>

src/main/scripts/ci/check-build-and-verify.sh

@@ -16,6 +16,7 @@ BOOTLINT_FAIL=
 JASMINE_FAIL=
 HTML_FAIL=
 TEST_FAIL=
+FINDBUGS_FAIL=
 VERIFY_FAIL=
 
 if [ "$RUN_ONLY_INTEGRATION_TESTS" = 'no' ]; then
@@ -41,6 +42,8 @@ if [ "$RUN_ONLY_INTEGRATION_TESTS" = 'no' ]; then
 		--show-warnings \
 		>validator.log 2>&1 || HTML_FAIL=yes
 	mvn --batch-mode test -Denforcer.skip=true -DskipMinify=true >test.log 2>&1 || TEST_FAIL=yes
+	# run after tests for getting compiled sources
+	mvn --batch-mode findbugs:check >findbugs.log 2>&1 || FINDBUGS_FAIL=yes
 fi
 
 mvn --batch-mode verify -Denforcer.skip=true -DskipUnitTests=true >verify.log 2>&1 || VERIFY_FAIL=yes
@@ -59,6 +62,7 @@ if [ "$RUN_ONLY_INTEGRATION_TESTS" = 'no' ]; then
 	print_status "$JASMINE_FAIL"  'Run JavaScript unit tests'
 	print_status "$HTML_FAIL"     'Run html5validator'
 	print_status "$TEST_FAIL"     'Run unit tests'
+	print_status "$FINDBUGS_FAIL" 'Run FindBugs'
 fi
 
 print_status "$VERIFY_FAIL" 'Run integration tests'
@@ -75,12 +79,13 @@ if [ "$RUN_ONLY_INTEGRATION_TESTS" = 'no' ]; then
 	print_log jasmine.log   'Run JavaScript unit tests'
 	print_log validator.log 'Run html5validator'
 	print_log test.log      'Run unit tests'
+	print_log findbugs.log  'Run FindBugs'
 fi
 
 print_log verify.log   'Run integration tests'
 
-rm -f cs.log pmd.log codenarc.log license.log bootlint.log jasmine.log validator.log test.log verify.log
+rm -f cs.log pmd.log codenarc.log license.log bootlint.log jasmine.log validator.log test.log findbugs.log verify.log
 
-if [ -n "$CS_FAIL$PMD_FAIL$CODENARC_FAIL$LICENSE_FAIL$POM_FAIL$BOOTLINT_FAIL$JASMINE_FAIL$HTML_FAIL$TEST_FAIL$VERIFY_FAIL" ]; then
+if [ -n "$CS_FAIL$PMD_FAIL$CODENARC_FAIL$LICENSE_FAIL$POM_FAIL$BOOTLINT_FAIL$JASMINE_FAIL$HTML_FAIL$TEST_FAIL$FINDBUGS_FAIL$VERIFY_FAIL" ]; then
 	exit 1
 fi