feat: add code quality tooling (compiler warnings + static analysis) #28#29
Open
Ayush-AM wants to merge 1 commit intoopenmainframeproject:masterfrom
Open
Conversation
…penmainframeproject#28 Address OpenSSF Best Practices quality-related recommendations from issue openmainframeproject#28: Compiler Warnings: - Java: enable -Xlint:all via maven-compiler-plugin compilerArgs in pom.xml - C++: add -Wall -Wextra -Wpedantic to CXXFLAGS in cpp/envdef.mak - No -Werror used; warnings are informational only Static Analysis: - Java: add SpotBugs Maven plugin (v4.9.3.1) configured as best-effort (failOnError=false, effort=Max, threshold=Low, noClassOk=true) Run with: mvn spotbugs:check or mvn spotbugs:gui - C++: add 'lint' target in cpp/Makefile that runs cppcheck Run with: make lint (from cpp/ directory) Documentation: - Add QUALITY.md at repo root documenting: * enabled compiler warning flags for Java and C++ * static analysis tools and how to run them locally * best-effort nature with no SLA guarantees Verified locally: - mvn compile: BUILD SUCCESS with Xlint warnings surfaced - mvn spotbugs:check: BUILD SUCCESS, 55 findings reported - C++ warning flags: syntactically valid, apply to clang++ and ibm-clang++ - make lint: wired up, requires cppcheck installation to run Signed-off-by: Ayush Mahajan <140263932+Ayush-AM@users.noreply.github.com>
Contributor
|
Hello, thank you for the initiative, we always welcome contribution. |
Author
Thank you for the guidance. I’ll target the current release branch instead of master. I’ll also enable warnings, share the results, and open additional issues if needed to address them. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #28
Addresses all three OpenSSF Best Practices quality-related recommendations:
compiler warnings, static analysis, and documentation.
What changed and why
pom.xml— Java compiler warnings + SpotBugsCompiler warnings:
Added
-Xlint:alltomaven-compiler-plugin's<compilerArgs>. This surfacesall Java lint diagnostics on every
mvn compile/mvn packagerun withoutfailing the build (
-Werroris intentionally not used).Static analysis:
Added the SpotBugs Maven plugin (
v4.9.3.1).Configured as best-effort so it never blocks the build:
failOnErrorfalseeffortMaxthresholdLownoClassOktrueRun locally: