# Share a SpotBugs HTML Report — Java Bug Patterns at a URL

Canonical: https://commareports.com/share-spotbugs-report
Published: 2026-08-30

> SpotBugs writes an HTML report into build/reports or target/site, where nobody reads it. Publish it to Comma so each bug pattern gets triaged in place instead of in a CI log.

# Share a SpotBugs report

SpotBugs finds the things code review misses — the null that is only null on
the error path, the `equals` without a `hashCode`, the stream that never gets
closed. It reports them in an HTML file that lands somewhere like:

```
build/reports/spotbugs/main.html      # Gradle
target/site/spotbugs.html             # Maven, via the site lifecycle
```

and is read by exactly one person: whoever was debugging the build.

## Enable HTML, publish it

```kotlin
// build.gradle.kts
spotbugs {
    ignoreFailures.set(false)
}
tasks.spotbugsMain {
    reports.create("html") {
        required.set(true)
        setStylesheet("fancy-hist.xsl")
    }
}
```

```bash
./gradlew spotbugsMain

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html build/reports/spotbugs/main.html \
        --arg title "SpotBugs — $GITHUB_SHA" '{title: $title, html: $html}')"
```

For a one-off, drag the file into [the app](https://commareports.com/).

Note the Gradle plugin's one-report-per-task rule: pick HTML for the artifact
humans read, and produce SARIF from a separate task if something downstream
needs to parse it.

## Triage where the finding is

Half of a SpotBugs report is real and half is a pattern that does not apply to
your code. Sorting them is the work, and it is worth recording:

- **Anchored threads** on the bug pattern — "intentional, the field is only
  written under the lock" — see [commenting on HTML](/comment-on-html).
- **Revisions** — one report id per module, one revision per build, so an
  exclusion-filter change is visible instead of asserted.
- **Access per report** — private, team, domain-gated, or named reviewers.
  See the [sharing model](/docs/sharing).

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a SpotBugs report →](https://commareports.com/)**

### Related

- [Share a Checkstyle report](/share-checkstyle-report) · [Share a detekt report](/share-detekt-report)
- [Share a JaCoCo report](/share-jacoco-report) · [Share a PIT mutation report](/share-pitest-report)
- [Share a Maven site report](/share-maven-site-report) · [Publish from CI](/docs/ci)