Simple gradle file using spotbugs and find security bugs?

Question

Does anyone have a basic gradle file for gradle 5.X using the "old" form of plugin entry, that uses both spotbugs and find-security-bugs, and that, when ./gradlew clean build is run will execute both spot bugs and security bugs?

I can get spot bugs working (why did they rename it? how annoying) but cannot get the security bugs working.

Answer 1

From this useful blog https://www.amolsolutions.com/insights/static-code-checks-for-security

plugins {

    id 'com.gradle.build-scan' version '1.12.1'

    id "com.github.spotbugs" version "1.6.2"

}

dependencies {

  ...

  spotbugsPlugins 'com.h3xstream.findsecbugs:findsecbugs-plugin:1.7.1'

}

...

tasks.withType(com.github.spotbugs.SpotBugsTask) {

  reports {

    xml.enabled false

    html.enabled true

  }

}

You'll know it worked because a link "security" will appear in the section list.