From 3295638ca53c4933367d29c8e283c3a236466703 Mon Sep 17 00:00:00 2001
From: Stefan Richter-Huber <stefan@richter-huber.de>
Date: Mon, 2 Mar 2026 12:14:04 +0100
Subject: [PATCH] Added spotbugs and fixed bugs found by spotbugs

---
 .github/workflows/maven.yml                   |  6 ++--
 pom.xml                                       | 34 +++++++++++++++++++
 spotbugs-ignore.xml                           |  5 +++
 .../quickjswasmjava/QuickJSPromise.java       |  2 +-
 .../ScriptInvocationHandler.java              |  2 +-
 src/test/resources/log4j2.xml                 |  2 +-
 6 files changed, 46 insertions(+), 5 deletions(-)
 create mode 100644 spotbugs-ignore.xml

diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 10f6b26..c90a9f4 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -30,10 +30,12 @@ jobs:
         cache: maven
     - name: Install target wasm32-wasip1
       run: rustup target add wasm32-wasip1
+    - name: Install wasm-opt
+      run: cargo install wasm-opt
     - name: Build with Maven
-      run: mvn -B package --file pom.xml
+      run: mvn -P spotbugs,wasm-opt -B package --file pom.xml
     
-      # 2. Parse the report and comment on the PR
+      # Parse the test coverage report and comment on the PR
     - name: JaCoCo Report to PR
       id: jacoco
       uses: madrapps/jacoco-report@v1.7.1
diff --git a/pom.xml b/pom.xml
index 1b4ae48..c6ba0b2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -353,5 +353,39 @@
                 </plugins>
             </build>
         </profile>
+
+        <!-- Optional (because it takes very long) invocation of spotbugs to scan for security
+        issues-->
+        <profile>
+            <id>spotbugs</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>com.github.spotbugs</groupId>
+                        <artifactId>spotbugs-maven-plugin</artifactId>
+                        <version>4.9.8.2</version>
+                        <executions>
+                            <execution>
+                                <goals>
+                                    <goal>check</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                        <configuration>
+                            <excludeFilterFile>spotbugs-ignore.xml</excludeFilterFile>
+                            <maxHeap>2048</maxHeap>
+                            <plugins>
+                                <plugin>
+                                    <groupId>com.h3xstream.findsecbugs</groupId>
+                                    <artifactId>findsecbugs-plugin</artifactId>
+                                    <version>1.14.0</version>
+                                </plugin>
+                            </plugins>
+                        </configuration>
+                    </plugin>
+
+                </plugins>
+            </build>
+        </profile>
     </profiles>
 </project>
\ No newline at end of file
diff --git a/spotbugs-ignore.xml b/spotbugs-ignore.xml
new file mode 100644
index 0000000..786dcab
--- /dev/null
+++ b/spotbugs-ignore.xml
@@ -0,0 +1,5 @@
+<FindBugsFilter>
+    <Match>
+        <Class name="~.*WasmLib.*" />
+    </Match>
+</FindBugsFilter>
diff --git a/src/main/java/io/github/stefanrichterhuber/quickjswasmjava/QuickJSPromise.java b/src/main/java/io/github/stefanrichterhuber/quickjswasmjava/QuickJSPromise.java
index c521f6f..682fe0b 100644
--- a/src/main/java/io/github/stefanrichterhuber/quickjswasmjava/QuickJSPromise.java
+++ b/src/main/java/io/github/stefanrichterhuber/quickjswasmjava/QuickJSPromise.java
@@ -14,7 +14,7 @@
  * CompletableFuture to provide a Java
  * interface to the promise.
  */
-class QuickJSPromise extends CompletableFuture<Object> {
+final class QuickJSPromise extends CompletableFuture<Object> {
     private static final Logger LOGGER = LogManager.getLogger();
 
     private long promisePtr;
diff --git a/src/main/java/io/github/stefanrichterhuber/quickjswasmjava/ScriptInvocationHandler.java b/src/main/java/io/github/stefanrichterhuber/quickjswasmjava/ScriptInvocationHandler.java
index bacf148..dc5e0b9 100644
--- a/src/main/java/io/github/stefanrichterhuber/quickjswasmjava/ScriptInvocationHandler.java
+++ b/src/main/java/io/github/stefanrichterhuber/quickjswasmjava/ScriptInvocationHandler.java
@@ -7,7 +7,7 @@
  * Invocation handler for a QuickJS context. This allows to create a dynamic
  * proxy for the QuickJS context / a QuickJS object.
  */
-class ScriptInvocationHandler<K, V> implements InvocationHandler {
+final class ScriptInvocationHandler<K, V> implements InvocationHandler {
 
     /**
      * The QuickJS context to use.
diff --git a/src/test/resources/log4j2.xml b/src/test/resources/log4j2.xml
index 5920749..e65e0e4 100644
--- a/src/test/resources/log4j2.xml
+++ b/src/test/resources/log4j2.xml
@@ -5,7 +5,7 @@
         </Console>
     </Appenders>
     <Loggers>
-        <Root level="debug">
+        <Root level="info">
             <AppenderRef ref="Console" />
         </Root>
     </Loggers>