Run FindBugs by default in components

[oleg-nenashev]

I am tired of setting up FindBugs for every core component/plugin separately, so I would like to generalize it in the parent POM.

The current implementation is taken from the https://github.com/jenkinsci/plugin-pom with some extra patches for the core support.

• - Patch here
• - Downstream PR for the core: Update to Parent POM 1.40 with configured FindBugs jenkins#3308
• - Downstream PR for Remoting: Update Remoting to Parent POM 1.40 with integrated FindBugs check remoting#257
• - Downstream PR for Winstone: Use standard Jenkins POM in Winstone, Refactor the project structure winstone#46

[oleg-nenashev]

@reviewbybees @dwnusbaum . I still need to create some downstream PRs before we go forward

[dwnusbaum]

Should this comment be removed since excludeFilterFile is defined a few lines below?

[oleg-nenashev]

yeah, likely.

[dwnusbaum]

🐝 I think this makes sense and the defaults look good to me. I recall seeing the jsr305 dependency (I think it adds @Nonnull) listed in tandem with findbugs in various places, should it be added here as well? (Seems likely to not matter but I wanted to make sure.)

[oleg-nenashev]

@reviewbybees done. All downstream PRs have been also approved, so I will just ship it for now.

I recall seeing the jsr305 dependency (I think it adds @nonnull) listed in tandem with findbugs in various places, should it be added here as well? (Seems likely to not matter but I wanted to make sure.)

Last time I tried to introduce a dependency in parent POM, reviewers said that it's better to keep all such things in dependencyManagement only. Which totally makes sense in the case of JSR305, because there are some license concerns with JSR305 annotation libraries: findbugsproject/findbugs#128.

I think we will need to revisit it when we migrate to SpotBugs which offers new annotations without license obstacles. For now I will avoid including it in the core-wide parent POM.