KAFKA-4773; The Kafka build should run findbugs

Author: Colin P. Mccabe <cmccabe@confluent.io>

Reviewers: Ismael Juma <ismael@juma.me.uk>

Closes #2557 from cmccabe/KAFKA-4773

README.md

@@ -133,11 +133,26 @@ Please note for this to work you should create/update `${GRADLE_USER_HOME}/gradl
 ### Determining if any dependencies could be updated ###
     ./gradlew dependencyUpdates
 
-### Running checkstyle on the java code ###
+### Running code quality checks ###
+There are two code quality analysis tools that we regularly run, findbugs and checkstyle.
+
+#### Checkstyle
+Checkstyle enforces a consistent coding style in Kafka.
+You can run checkstyle using:
+
     ./gradlew checkstyleMain checkstyleTest
 
-This will most commonly be useful for automated builds where the full resources of the host running the build and tests
-may not be dedicated to Kafka's build.
+The checkstyle warnings will be found in `reports/checkstyle/reports/main.html` and `reports/checkstyle/reports/test.html` files in the
+subproject build directories. They are also are printed to the console. The build will fail if Checkstyle fails.
+
+#### Findbugs
+Findbugs uses static analysis to look for bugs in the code.
+You can run findbugs using:
+
+    ./gradlew findbugsMain findbugsTest -x test
+
+The findbugs warnings will be found in `reports/findbugs/main.html` and `reports/findbugs/test.html` files in the subproject build
+directories. Currently, findbugs warnings do not cause the build to fail.
 
 ### Common build options ###
 

build.gradle

@@ -125,6 +125,7 @@ subprojects {
   apply plugin: 'maven'
   apply plugin: 'signing'
   apply plugin: 'checkstyle'
+  apply plugin: 'findbugs'
 
   sourceCompatibility = 1.7
 
@@ -278,6 +279,19 @@ subprojects {
   }
   test.dependsOn('checkstyleMain', 'checkstyleTest')
 
+  findbugs {
+    toolVersion = "3.0.1"
+    excludeFilter = file("$rootDir/gradle/findbugs-exclude.xml")
+    ignoreFailures = true
+  }
+
+  tasks.withType(FindBugs) {
+    reports {
+      xml.enabled false
+      html.enabled true
+    }
+  }
+
   // Ignore core since its a scala project
   if (it.path != ':core') {
     // NOTE: Gradles Jacoco plugin does not support "offline instrumentation" this means that classes mocked by PowerMock

gradle/findbugs-exclude.xml

@@ -0,0 +1,28 @@
+<!--
+   Licensed to the Apache Software Foundation (ASF) under one or more
+   contributor license agreements.  See the NOTICE file distributed with
+   this work for additional information regarding copyright ownership.
+   The ASF licenses this file to You under the Apache License, Version 2.0
+   (the "License"); you may not use this file except in compliance with
+   the License.  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+-->
+
+<FindBugsFilter>
+    <!-- Exclude a few findbugs codes.
+         EI: May expose internal representation by returning reference to mutable object.
+         EI2: May expose internal representation by incorporating reference to mutable object.
+         MS: Malicious code vulnerability.
+         See http://findbugs.sourceforge.net/bugDescriptions.html for a full description of the findbugs codes.
+    -->
+    <Match>
+        <Bug code="EI,EI2,MS"/>
+    </Match>
+</FindBugsFilter>