From 3a47de8c786daf7c671c0410224d813af6582bdb Mon Sep 17 00:00:00 2001
From: Arthit Suriyawongkul <arthit@gmail.com>
Date: Fri, 17 Jul 2026 02:14:43 +0100
Subject: [PATCH 1/2] Add SpotBugs analysis

Also replace findbugs-maven-plugin with spotbugs-maven-plugin for reporting.

Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
---
 .github/workflows/build.yml | 47 +++++++++++++++++++++++++++++++++----
 pom.xml                     | 22 ++++++++++++++---
 2 files changed, 62 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 61d2face1..b10a2f781 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,22 +15,22 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         fetch-depth: 0
     - name: Set up JDK 17
-      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165  # v5.0.0
+      uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
       with:
         distribution: 'temurin'
         java-version: 17
     - name: Cache SonarCloud packages
-      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809  # v4.2.4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
       with:
         path: ~/.sonar/cache
         key: ${{ runner.os }}-sonar
         restore-keys: ${{ runner.os }}-sonar
     - name: Cache Maven packages
-      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809  # v4.2.4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
       with:
         path: ~/.m2
         key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
@@ -45,3 +45,42 @@ jobs:
         else
            mvn --batch-mode --update-snapshots verify
         fi
+
+  spotbugs:
+    if: github.event_name == 'pull_request'
+
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+    - name: Set up JDK 17
+      uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
+      with:
+        distribution: 'temurin'
+        java-version: 17
+    - name: Cache Maven packages
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+      with:
+        path: ~/.m2
+        key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+        restore-keys: ${{ runner.os }}-m2
+    - name: Run SpotBugs analysis
+      run: mvn --batch-mode --update-snapshots compile com.github.spotbugs:spotbugs-maven-plugin:spotbugs
+    - name: Upload SpotBugs SARIF report
+      if: always()
+      continue-on-error: true
+      uses: github/codeql-action/upload-sarif@bb16b9baa2ec4010b29f5c606d57d01190139edd  # v4.37.1
+      with:
+        sarif_file: target/spotbugsSarif.json
+        category: spotbugs
+    - name: Fail job if SpotBugs found bugs
+      run: |
+        bug_count=$(grep -o '<BugInstance' target/spotbugsXml.xml | wc -l | tr -d '[:space:]' || true)
+        if [ "$bug_count" -gt 0 ]; then
+          echo "::error::SpotBugs found $bug_count bug(s). See the Checks/Security tab for annotated details."
+          exit 1
+        fi
diff --git a/pom.xml b/pom.xml
index de41b58f9..5ce2cfe63 100644
--- a/pom.xml
+++ b/pom.xml
@@ -310,6 +310,18 @@
 				<artifactId>dependency-check-maven</artifactId>
 				<version>${dependency-check-maven.version}</version>
 			</plugin>
+			<plugin>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-maven-plugin</artifactId>
+				<version>4.10.3.0</version>
+				<configuration>
+					<effort>Max</effort>
+					<threshold>High</threshold>
+					<xmlOutput>true</xmlOutput>
+					<sarifOutput>true</sarifOutput>
+					<failOnError>true</failOnError>
+				</configuration>
+			</plugin>
 			<plugin>
 				<groupId>org.codehaus.mojo</groupId>
 				<artifactId>build-helper-maven-plugin</artifactId>
@@ -339,9 +351,13 @@
 	<reporting>
 		<plugins>
 			<plugin>
-				<groupId>org.codehaus.mojo</groupId>
-				<artifactId>findbugs-maven-plugin</artifactId>
-				<version>3.0.5</version>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-maven-plugin</artifactId>
+				<version>4.10.3.0</version>
+				<configuration>
+					<effort>Max</effort>
+					<threshold>High</threshold>
+				</configuration>
 			</plugin>
 		</plugins>
 	</reporting>

From 528590372dbf09de5362e9e975335a3786ee5426 Mon Sep 17 00:00:00 2001
From: Arthit Suriyawongkul <arthit@gmail.com>
Date: Fri, 17 Jul 2026 02:24:38 +0100
Subject: [PATCH 2/2] Trigger spotbugs at push too

Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b10a2f781..1b8171dfd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -47,7 +47,7 @@ jobs:
         fi
 
   spotbugs:
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request' || github.event_name == 'push'
 
     runs-on: ubuntu-latest