gradle-static-analysis-plugin

A Gradle plugin to easily apply the same setup of static analysis tools across different Android or Java projects.

Description

Gradle supports many popular static analysis (Checkstyle, PMD, FindBugs, etc) via a set of built-in plugins. Using these plugins in an Android module will require an additional setup to compensate for the differences between the model adopted by the Android plugin compared to the the Java one.

The gradle-static-analysis-plugin aims to provide:

• flexible, configurable penalty strategy for builds,
• easy, Android-friendly integration for all static analysis,
• convenient way of sharing same setup across different projects,
• healthy, versionable and configurable defaults.

Adding to your project

The plugin is released in jcenter and can be included as a classpath dependency:

buildscript {
    repositories {
       jcenter()
    }
    dependencies {
        classpath 'com.novoda:gradle-static-analysis-plugin:0.4.1'
    }
}

and then apply the plugin via:

apply plugin: 'com.novoda.static-analysis'

Simple usage

A typical configuration for the plugin will look like:

staticAnalysis {
    penalty {
        maxErrors = 0
        maxWarnings = 100
    }
    checkstyle {
        configFile project.file('path/to/modules.xml')
    }
    pmd {
        ruleSetFiles = project.files('path/to/rules.xml')
    }
    findbugs {}
}

Configurable thresholds

Users can define maximum amount of warnings and errors tolerated in a build via the gradle configuration:

staticAnalysis {
    penalty {
        maxErrors = 10
        maxWarnings = 10
    }
}

Violations are then collected while running all the static analysis tools enabled in the project and split between errors and warnings. Only in the end they are cumulatively evaluated against the thresholds provided in the configuration to decide whether the build should fail or not.

Better output

Build logs will show an overall report of how many violations have been found during the analysis and the links to the relevant html reports, for instance:

    > PMD rule violations were found (2 errors, 2 warnings). See the reports at:
    - file:///foo/project/build/reports/pmd/main.html
    - file:///foo/project/build/reports/pmd/main2.html
    - file:///foo/project/build/reports/pmd/main3.html
    - file:///foo/project/build/reports/pmd/main4.html

It's possible to specify a custom renderer for the report urls in the logs via the logs extension. This can be useful in CI environments, where the local paths are not reachable directly. For instance the snippet below will replace the base url with one of your choice:

staticAnalysis {
    ...
    logs {
        reportBaseUrl "http://ci.mycompany.com/job/myproject/ws/app/build/reports"
    }
}

so that in the logs you will see the report urls printed as

> Checkstyle rule violations were found (0 errors, 1 warnings). See the reports at:
- http://ci.mycompany.com/job/myproject/ws/app/build/reports/checkstyle/main.html

More info on the topic can be found in the LogsExtension groovydoc.

Out-of-the-box support for Android projects

Android projects use a gradle model that is not compatible with the Java one, supported by the built-in static analysis tools plugins. Applying gradle-static-analysis-plugin to your Android project will make sure all the necessary tasks are created and correctly configured without any additional hassle.

Support for exclude filters

You can specify custom patterns to exclude specific files from the static analysis. All you have to do is to specify exclude in the configuration of your tool of choice:

staticAnalysis {
    findbugs {
        exclude '**/*Test.java' // file pattern
        exclude project.fileTree('src/test/java') // entire folder
        exclude project.file('src/main/java/foo/bar/Constants.java') // specific file
        exclude project.sourceSets.main.java.srcDirs // entire source set
    }
}

Support for Android variants

Sometimes using exclude filters could be not enough. When using the plugin in an Android project you may want to consider only one specific variant as part of the analysis. The plugin provides a way of defining which Android variant should be included via the includeVariants method added to each tool extension. Eg:

staticAnalysis {
    findbugs {
        includeVariants { variant ->
            variant.name.equals('debug') // only the debug variant
        }
    }
}

Current status / Roadmap

The plugin is under early development and to be considered in pre-alpha stage.

Static analysis tools supported

Tool	Android	Java	Documentation
Checkstyle	✅	✅	Coming Soon
PMD	✅	✅	Coming Soon
FindBugs	✅	✅	Coming Soon

Support for sharable configurations

The plugin can consume rules (eg: configuration files for Checkstyle or PMD, default exclude filters, etc) via a separate artifact you can share across projects.