Customise findbugs rules for Scala -- reduce false positives, add scala specific rules about sbt-findbugs

[josephearl]

FindBugs is not designed to analyse Scala code, I'd suggest you use something like https://github.com/scalastyle/scalastyle on your Scala code, and only run FindBugs on your Java code.

[RichardBradley]

I'd suggest you use something like scalastyle on your Scala code, and only run FindBugs on your Java code.

Scalastyle is a regex based rule engine; it's not really comparable to FindBugs. It's closer to a source code formatter.
A closer equivalent is scapegoat.

There is some discussion on scapegoat-scala/scapegoat#38 about Findbugs v.s. Scapegoat.
I believe that there may be some useful knowledge about the Java standard libraries in Findbugs which may be applicable to Scala programs, but many of the rules are inapplicable, you are right.

If the general conclusion is that Findbugs is completely inapplicable to Scala, then findbugs4sbt should run only on Java sources -- currently it does try to run Findbugs on bytecode from Scala sources.

[josephearl]

I wouldn't say scalastyle is regex - it parses the Scala AST and applies rules to that. But it doesn't really do any static analysis, you're right.

This StackOverflow post also has some alternates: http://stackoverflow.com/questions/22617713/whats-the-current-state-of-static-analysis-tools-for-scala

If the general conclusion is that Findbugs is completely inapplicable to Scala, then findbugs4sbt should run only on Java sources -- currently it does try to run Findbugs on bytecode from Scala sources.

Personally I think it is and would vote to change it, although I can't speak for the project maintainers

FindBugs works "out of the box" for Java, and the rules it has detect issues with commonly written Java code.

This isn't the case for Scala, and I would argue the changes to support it are out of the scope of this project. Scala support should be added to the main FindBugs tool (or an extension of it) so that things like running it directly from the command line work, not in an SBT plugin.