sdks/java/build-tools/src/main/resources/beam/spotbugs-filter.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
    Licensed to the Apache Software Foundation (ASF) under one or more
    contributor license agreements.  See the NOTICE file distributed with
    this work for additional information regarding copyright ownership.
    The ASF licenses this file to You under the Apache License, Version 2.0
    (the "License"); you may not use this file except in compliance with
    the License.  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
-->
<FindBugsFilter>
  <!--
    Beam UDFs are intended to be serialized for transmission only. There is no expectation that they can
    be stored and read by a different version of the code.
  -->
  <Bug pattern="SE_NO_SERIALVERSIONID"/>

  <!--
    The preferred way to find nullness errors is {@code enableChecker: true}. If a module has
    many Spotbugs nullness errors, it is not worthwhile to fix them. But Spotbugs is useful for
    other coding issues. Instead of disabling spotbugs, turn on this flag.

    More context: Migration from Findbugs to Spotbugs caused a loss of coverage for nullness. Then upgrade
    from Spotbugs 3.1.12 to 4.0.6 found hundreds of new nullness errors spread throughout all modules.
    It is not worthwhile to fix them, but instead they are disabled and the modules should eventually be
    fixed to pass the Checker Framework nullness type system.
  -->
  <Bug code="NP,RCN" />

  <!--
    When arrays are passed in and out of objects, spotbugs warns. Yet most objects are mutable in some way in
    Java and carry the same risk. These warning codes produce a large number of unhelpful errors having to do with
    passing byte[] arrays around, since Beam deals in serialized data. Trusting callers and callees not to mutate
    things inappropriately is inherent to Java.
  -->
  <Bug code="EI,EI2" />

  <!--
    Beam DoFns are invoked via reflection by looking at the annotations. To spotbugs, these methods
    seem to be uncallable because they are on anonymous classes.
  -->
  <Bug pattern="UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS"/>

  <!--
    Many test classes are captured by lambdas and marked `implements Serializable`. They are not
    actually serializable, so the TestPipeline that they employ does not need to be transient or
    serializable.
  -->
  <Match>
    <Bug pattern="SE_BAD_FIELD" />
    <Class name=".*Test$" />
    <Field type="org.apache.beam.sdk.testing.TestPipeline" />
  </Match>

  <!-- Suppress checking of autogenerated classes -->
  <Match>
    <Class name="~.*AutoValue_.*"/>
  </Match>
  <Match>
    <Package name="org.apache.beam.sdk.extensions.sql.impl.parser.impl"/>
  </Match>
  <Match>
    <Package name="org.apache.beam.sdk.schemas.parser.generated"/>
  </Match>
  <Match>
    <Package name="org.apache.beam.sdk.io.clickhouse.impl.parser"/>
  </Match>
</FindBugsFilter>