Skip to content

Commit 079e5c0

Browse files
sebhosssebhoss
committed
add more static analysis
Signed-off-by: Sebastian Hoß <seb@xn--ho-hia.de>
1 parent cc621d0 commit 079e5c0

11 files changed

Lines changed: 181 additions & 75 deletions

File tree

‎.github/actions/managed-java/action.yml‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎.github/actions/managed-maven/action.yml‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

‎.github/dependabot.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# SPDX-FileCopyrightText: The ilo Authors
2+
# SPDX-License-Identifier: 0BSD
3+
4+
version: 2
5+
updates:
6+
- package-ecosystem: github-actions
7+
directory: /
8+
schedule:
9+
interval: daily
10+
assignees:
11+
- sebhoss
12+
- package-ecosystem: maven
13+
directory: /
14+
schedule:
15+
interval: daily
16+
assignees:
17+
- sebhoss

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 0 additions & 31 deletions
This file was deleted.

‎.github/workflows/release.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
steps:
1515
- id: checkout
1616
name: Clone Git Repository
17-
uses: actions/checkout@v4
17+
uses: actions/checkout@v6
1818
with:
1919
fetch-depth: 0
2020
- id: last_release
@@ -38,8 +38,16 @@ jobs:
3838
if: steps.commits.outputs.count > 0
3939
run: echo "iso8601=$(date --utc --iso-8601=seconds)" >> $GITHUB_OUTPUT
4040
- id: setup-java
41-
uses: ./.github/actions/managed-maven
41+
name: Set up Java
4242
if: steps.commits.outputs.count > 0
43+
uses: actions/setup-java@v4
44+
with:
45+
java-version: 25
46+
distribution: temurin
47+
cache: maven
48+
server-id: ossrh
49+
server-username: MAVEN_CENTRAL_USERNAME
50+
server-password: MAVEN_CENTRAL_TOKEN
4351
- id: gpg
4452
name: GPG Key
4553
if: steps.commits.outputs.count > 0

‎.github/workflows/update-parent.yml‎

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,30 @@ jobs:
99
parent:
1010
runs-on: ubuntu-latest
1111
steps:
12-
- name: Clone Git Repository
13-
uses: actions/checkout@v4
14-
- uses: ./.github/actions/managed-java
15-
- name: Update Parent
12+
- id: checkout
13+
name: Clone Git Repository
14+
uses: actions/checkout@v6
15+
- id: graal
16+
name: Set up GraalVM
17+
uses: graalvm/setup-graalvm@v1
18+
with:
19+
version: latest
20+
java-version: 25
21+
github-token: ${{ secrets.GITHUB_TOKEN }}
22+
- id: cache
23+
name: Cache Maven Repository
24+
uses: actions/cache@v5
25+
with:
26+
path: ~/.m2/repository
27+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
28+
restore-keys: |
29+
${{ runner.os }}-maven-
30+
- id: parent
31+
name: Update Parent
1632
run: mvn --batch-mode --define generateBackupPoms=false versions:update-parent
1733
- id: cpr
1834
name: Create Pull Request
19-
uses: peter-evans/create-pull-request@v5
35+
uses: peter-evans/create-pull-request@v6
2036
with:
2137
token: ${{ secrets.PAT }}
2238
commit-message: Update parent to latest version

‎.github/workflows/verify.yml‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,26 @@ jobs:
99
verify:
1010
runs-on: ubuntu-latest
1111
steps:
12-
- name: Clone Git Repository
13-
uses: actions/checkout@v4
14-
- uses: ./.github/actions/managed-java
15-
- name: Build with Maven
12+
- id: checkout
13+
name: Clone Git Repository
14+
uses: actions/checkout@v6
15+
- id: graal
16+
name: Set up GraalVM
17+
uses: graalvm/setup-graalvm@v1
18+
with:
19+
version: latest
20+
java-version: 25
21+
github-token: ${{ secrets.GITHUB_TOKEN }}
22+
- id: cache
23+
name: Cache Maven Repository
24+
uses: actions/cache@v5
25+
with:
26+
path: ~/.m2/repository
27+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
28+
restore-keys: |
29+
${{ runner.os }}-maven-
30+
# The native profile runs PMD + SpotBugs (bound to verify) and builds and runs the
31+
# native-image smoke check, so a green run proves both code quality and native compatibility.
32+
- id: verify
33+
name: Verify Project
1634
run: mvn --batch-mode --activate-profiles=native verify

‎CLAUDE.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,17 @@ JDK 25 (`global.jdkVersion` in `pom.xml`), Maven. Inherits most config from the
1919
- Native-compatibility check (what CI's PR check runs — the GraalVM `native` profile): `mvn --batch-mode --activate-profiles=native verify`
2020
- Single test class: `mvn test -Dtest=DevcontainerParsingTest`
2121

22+
`verify` also runs the quality gates (see below). `.github/workflows/verify.yml` runs the native command above on GraalVM 25, so PMD, SpotBugs, and the native smoke check all gate every PR.
23+
2224
The local machine has no JDK/Maven installed; run builds through `ilo` (see global instructions) or in the GraalVM container CI uses.
2325

26+
## Code quality gates (bound to `verify`)
27+
28+
- **PMD** (`check` + `cpd-check`, from the parent) with a focused ruleset in `config/pmd/ruleset.xml`. The generated-sources root is excluded via `excludeRoots`.
29+
- **SpotBugs** (`check`) with `config/spotbugs/exclude.xml`. The exclusions are deliberate: representation-exposure findings are expected for records holding `List`/`Map`, and the generated `*Builder` classes are not ours to restyle.
30+
31+
Both fail the build on findings. The PMD engine is pinned to 7.x so it can parse JDK 25 sources. When a quality gate flags generated code, exclude the generated artifact (root or class pattern) rather than the rule globally.
32+
2433
## Architecture
2534

2635
The schema is modeled as a graph of Java **records**, rooted at `Devcontainer`. Supporting records (`Build`, `Command`, `HostRequirements`, `PortAttribute`) and enums (`OnAutoForward`, `Protocol`, `ShutdownAction`, `UserEnvProbe`, `WaitFor`) cover the nested and constrained fields. Records carry the spec docs as Javadoc on each component.

‎config/pmd/ruleset.xml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
SPDX-FileCopyrightText: The devcontainer.java Authors
4+
SPDX-License-Identifier: 0BSD
5+
-->
6+
<ruleset name="devcontainer.java"
7+
xmlns="http://pmd.sourceforge.net/ruleset/2.0.0"
8+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
9+
xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 https://pmd.sourceforge.io/ruleset_2_0_0.xsd">
10+
11+
<description>
12+
Focused, low-noise rules: dead code, unnecessary imports, and cognitive complexity. Kept
13+
deliberately small so violations stay actionable.
14+
</description>
15+
16+
<rule ref="category/java/codestyle.xml/UnnecessaryImport"/>
17+
<rule ref="category/java/bestpractices.xml/UnusedLocalVariable"/>
18+
<rule ref="category/java/bestpractices.xml/UnusedPrivateField"/>
19+
<rule ref="category/java/bestpractices.xml/UnusedPrivateMethod"/>
20+
<rule ref="category/java/design.xml/CognitiveComplexity"/>
21+
22+
</ruleset>

‎config/spotbugs/exclude.xml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
SPDX-FileCopyrightText: The devcontainer.java Authors
4+
SPDX-License-Identifier: 0BSD
5+
-->
6+
<FindBugsFilter xmlns="https://github.com/spotbugs/filter/3.0.0"
7+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
8+
xsi:schemaLocation="https://github.com/spotbugs/filter/3.0.0 https://raw.githubusercontent.com/spotbugs/spotbugs/master/spotbugs/etc/findbugsfilter.xsd">
9+
10+
<!--
11+
The records model devcontainer.json and carry List/Map components. A record's canonical
12+
constructor and accessor necessarily store and return those references, which SpotBugs reports
13+
as representation exposure. The exposure is intended: the records are plain, immutable-by-convention
14+
data carriers, not defensive value objects.
15+
-->
16+
<Match>
17+
<Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
18+
</Match>
19+
20+
<!--
21+
record-builder generates the *Builder classes (and their nested With / _FromWith types). Their
22+
factory methods mirror the record name (e.g. Devcontainer(...)), which trips the method-naming
23+
convention check. Generated code is not ours to restyle, so it is excluded from analysis.
24+
-->
25+
<Match>
26+
<Class name="~.*Builder(\$.*)?"/>
27+
</Match>
28+
29+
</FindBugsFilter>

0 commit comments

Comments
 (0)