Comma

Share a SpotBugs report

SpotBugs finds the things code review misses — the null that is only null on the error path, the equals without a hashCode, the stream that never gets closed. It reports them in an HTML file that lands somewhere like:

build/reports/spotbugs/main.html      # Gradle
target/site/spotbugs.html             # Maven, via the site lifecycle

and is read by exactly one person: whoever was debugging the build.

Enable HTML, publish it

// build.gradle.kts
spotbugs {
    ignoreFailures.set(false)
}
tasks.spotbugsMain {
    reports.create("html") {
        required.set(true)
        setStylesheet("fancy-hist.xsl")
    }
}

./gradlew spotbugsMain

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html build/reports/spotbugs/main.html \
        --arg title "SpotBugs — $GITHUB_SHA" '{title: $title, html: $html}')"

For a one-off, drag the file into the app.

Note the Gradle plugin's one-report-per-task rule: pick HTML for the artifact humans read, and produce SARIF from a separate task if something downstream needs to parse it.

Triage where the finding is

Half of a SpotBugs report is real and half is a pattern that does not apply to your code. Sorting them is the work, and it is worth recording:

  • Anchored threads on the bug pattern — "intentional, the field is only written under the lock" — see commenting on HTML.
  • Revisions — one report id per module, one revision per build, so an exclusion-filter change is visible instead of asserted.
  • Access per report — private, team, domain-gated, or named reviewers. See the sharing model.

Limits

  • Entry HTML: 5 MB. Assets: 25 MB per file, 250 MB and 500 files total.
  • 60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a SpotBugs report →

Related