FindBugs is another library that we can use to analyze our source code. To use FindBugs in our Gradle builds, we simply have to apply the FindBugs plugin. We can either apply one source code analysis plugin to our project, or we can apply multiple plugins. Each tool has different features. It just depends on what we want to check or what is prescribed per company policy. The plugin will add the tasks findbugsMain and findbugsTest to analyze the source code from the main and test source sets. If we have a custom source set, then the task findbugs<SourceSet> is also added to the plugin. These tasks are all dependency tasks for the check task.

Just as with the other code quality plugins, the FindBugs dependencies are not included with Gradle, but will be downloaded the first time we use the findbugs tasks. We must include a repository definition that will enable Gradle to find the FindBugs dependencies. To change the FindBugs version that is being used, we can set the toolVersion property with the findbugs() method.

In the following build file, we apply the FindBugs plugin and configure an extra source set with the name webservice:

apply plugin: 'java'
apply plugin: 'findbugs'

repositories {
  mavenCentral()
}

findbugs {
  toolVersion = '2.0.0' // Default version with Gradle 1.1
}

sourceSets { 
    webservice
}

When we execute the tasks task, we see that the findbugsMain, findbugsTest, and findbugsWebservice tasks are dependencies for the check task:

$ gradle tasks --all
...

Verification tasks
------------------
check - Runs all checks. [classes, test, testClasses, webserviceClasses]
  findbugsMain - Run FindBugs analysis for main classes
  findbugsTest - Run FindBugs analysis for test classes
  findbugsWebservice - Run FindBugs analysis for webservice classes
test - Runs the unit tests. [classes, testClasses]

...

If FindBugs finds violations of the rules in our source, then the build will fail. We can set the property ignoreFailures to true, as shown in the following lines of code, to make sure the build will continue even if violations are found:

apply plugin: 'java'
apply plugin: 'findbugs'

repositories.mavenCentral()

// Global setting for all findbugs tasks.
findbugs.ignoreFailures = true

// We can change ignoreFailures property also per task.
findbugsMain.ignoreFailures = false

The plugin generates an XML report with the result of the FindBugs analysis in the directory build/reports/findbugs. The name of the XML file is the same as the name of the source set that is analyzed. We can also configure the plugin that an HTML report generates. In the following build file, we configure the reporting in the FindBugs plugin:

apply plugin: 'java'
apply plugin: 'findbugs'

repositories {
  mavenCentral()
}

findbugs {
  // Change base directory for FindBugs reports.
  reportsDir = file("${reporting.baseDir}/findbugs-output")
}

findbugsMain {
  reports {
    html {
      enabled = true

      // Change output file name.
      destination = "${findbugs.reportsDir}/findbugs.html"
    }
    // Only one report (xml or html) can be active.
    xml.enabled = !html.enabled
  }
}

If we want to use FindBugs plugins, we can define them as dependencies. The FindBugs plugin adds a findbugsPlugins dependency configuration. We can assign plugin dependencies to this configuration, and the findbugs tasks will use these plugins to analyze the code.