An SBT plugin to run SpotBugs with FindSecurityBugs plugin in your SBT build.

Add the following line to your project/plugins.sbt, replacing (current version) with the latest version:

addSbtPlugin("nl.codestar" % "sbt-findsecbugs" % "(current version)")`

(You can find the current version here.)

Optionally, override the default SpotBugs and FindSecBugs versions in your build.sbt:

findSecBugsSpotBugsVersion := "4.9.4"
findSecBugsSpotBugsPluginVersion := "1.14.0"

You can now run:

sbt findSecBugs

The plugin is an autoplugin, which means it is activated for all projects by default.

If you want to ignore a sub-project, you can add the following setting to that sub-project:

lazy val subProject = project.in(file("sub-folder"))
  .disablePlugins(FindSecBugs)

sbt-findsecbugs has several settings:

The plugin can be tested manually by running sbt findSecBugs in the test-project folder (this uses the local version of the plugin).

The plugin has automated tests which can be run by this command sbt scripted

To release a new version, make sure you have:

• proper access to the nl.codestar namespace on Sonatype.
• GnuPG (gpg) installed and a signing key configured.
  • We use sbt-pgp plugin to sign, which relies on the gpg command line tool
• create a .env file in the project root with the following variables:

  PGP_KEYID=<id of the signing key>
  PGP_PASSPHRASE=<your PGP passphrase>
  SONATYPE_USER=<user id or token id>
  SONATYPE_PASSWORD=<password or token>
  
  

Note: The .env file needs to be kept out of the git repository (it is .gitignored).

See Using Sonatype in the SBT documentation.

Steps to release (preferred):

1. Make sure the working copy is clean and up to date (no pending commits)
2. Tag the current commit with the next version number, e.g. git tag v0.21
   • NOTE: prefix the tag with v to indicate it is a version tag (this is a change since release 0.20, because we're using sbt-dynver now)
3. sbt publishSigned
4. sbt sonaUpload
5. Go to https://central.sonatype.com/publishing/deployments and publish the deployment.
   • or run sbt sonaRelease to publish the deployment automatically

Steps to release via manual zip upload:

1. Make sure the working copy is clean and up to date (no pending commits)
2. Tag the current commit with the next version number, e.g. git tag v0.21
   • NOTE: prefix the tag with v to indicate it is a version tag (this is a change since release 0.20, because we're using sbt-dynver now)
3. sbt publishLocalSigned
4. In the project root
   • ./make_bundle.sh
5. Upload the ./target/result.zip as a new deployment to the Sonatype nl.codestar namespace
   • https://central.sonatype.com/publishing
6. If the zip is validated, you can publish by clicking the Publish button, or drop to abandon the deployment

After a release, also create a release on Github:

1. Push the tag to the remote repository: git push origin v0.21
2. Go to the Releases page
3. Click on Draft a new release
4. Select the tag you just pushed, and fill in the release notes
5. Drag the bundle.zip from the target/sona-bundle folder into the release
6. Click on Publish release

Up to version 0.16, the plugin was released via BinTray / JFrog. Old versions can be found at https://scala.jfrog.io/ui/native/sbt-plugin-releases/nl.codestar/sbt-findsecbugs/