skills.rest
oriddd
oridddCOMMUNITY
Explore all skills by this author →
GitHub

static-analysis

Configures Spotless, SpotBugs, Error-Prone, and NullAway in Maven to fail builds on code violations.

Updated Jun 25, 2026
Search Tags:#code quality#static analysis#maven#nullaway#spotbugs#spotless#error-prone
One-click install
npx skills add https://github.com/oriddd/ai-toolkit --skill static-analysis-oriddd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: static-analysis
Source: https://github.com/oriddd/ai-toolkit/tree/main/copilot/public/skills/static-analysis
Command: npx skills add https://github.com/oriddd/ai-toolkit --skill static-analysis-oriddd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? New Java repositories often ship without enforced formatting or bug detection, letting style drift, null dereferences, and security bug patterns slip into production. This Skill wires a complete static analysis toolchain into Maven so objective violations break the build automatically. ## Core Features & Use Cases - Unified formatting: Spotless with google-java-format (AOSP) becomes the single canonical formatter, ending style debates in PRs. - Bug pattern detection: SpotBugs with FindSecBugs catches null derefs, resource leaks, SQLi, and XSS; Error-Prone and NullAway add compile-time bug and null-safety checks. - Build-breaking policy: Clear CI failure rules per tool (any Spotless diff, any HIGH SpotBugs finding, any new Error-Prone/NullAway violation, Sonar Quality Gate failure). - Use Case: When bootstrapping a new Spring Boot service, apply this Skill to get a pom.xml where mvn verify enforces formatting, bug patterns, and null-safety from the first commit. ## Quick Start Apply the static-analysis skill to wire Spotless, SpotBugs, Error-Prone, and NullAway into this repository's Maven build so violations fail the build.

Frequently Asked Questions about static-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce code formatting in a Maven Java project?▼

Use the Spotless Maven plugin with google-java-format (AOSP style) bound to the check goal so any formatting difference fails the build. Run mvn spotless:apply as the only way to format code, and configure IDE formatting to match Spotless output.

How do I set up SpotBugs with FindSecBugs in Maven?▼

Add the spotbugs-maven-plugin with effort Max, threshold Low, and failOnError true, then include the findsecbugs-plugin dependency for security patterns like SQLi and XSS. Bind the check goal so HIGH severity findings break the build.

What is the difference between SpotBugs, Error-Prone, and NullAway?▼

SpotBugs analyzes bytecode for bug patterns like null derefs and resource leaks, Error-Prone adds compile-time bug checks from Google, and NullAway enforces null-safety by treating annotated packages as non-null by default. They run together as complementary layers.

Does NullAway work with generated code like MapStruct mappers?▼

NullAway applies only to annotated packages defined via the AnnotatedPackages option, so generated code such as MapStruct mappers and JPA static metamodel is excluded by package. The -XepDisableWarningsInGeneratedCode flag also silences Error-Prone noise in generated sources.

When should I suppress a static analysis warning?▼

Suppress only with a @SuppressWarnings annotation plus a comment explaining why, reviewed in the PR. Project-wide suppressions belong in a checked-in spotbugs-exclude.xml, and you should never disable a check globally to fix a single false positive.

Related Skills

Explore More Software Engineering Skills→
serpro-workshop-fortalezaserpro-workshop-fortaleza

create-spring-boot-java-project

Generates a Spring Boot 3.3 Java 21 project scaffold with Maven, PostgreSQL, and Docker Compose.

Official
Intermediate
arcasilesgrouparcasilesgroup
54

ai-pr

Automate governed pull request workflows with pre-push gates and squash merge.

Official
Advanced
Open-PawsOpen-Paws
3

code-review

Automate layered code review for pull requests in CI pipelines.

Official
Advanced
bordenetbordenet
8

micro-harsh-review

Scores code changes with three-critic review and flags anti-patterns before commit.

Community
Intermediate