Maven SpotBugs "failed with ... bugs" - Fix Static-Analysis Gate in CI

The spotbugs-maven-plugin ran static analysis and found bug patterns at or above the configured threshold/failOnError. The spotbugs:check goal failed the build - a deliberate quality gate, not a transient error.

What this error means

The build fails with Failed during spotbugs execution or a count of bug instances, and the report names each class, method, and bug pattern (e.g. NP_NULL_ON_SOME_PATH, DM_DEFAULT_ENCODING).

mvn output

[ERROR] Failed to execute goal
com.github.spotbugs:spotbugs-maven-plugin:4.8.5.0:check (spotbugs) on project
app: failed with 2 bugs and 0 errors
[INFO]   H C NP: Possible null pointer dereference in com.example.App.load() [NP_NULL_ON_SOME_PATH]

Common causes

Real bug patterns detected in new code

SpotBugs found patterns like a possible null dereference, a default-encoding usage, or a returned mutable field. The check is configured to fail on them.

Threshold or effort tightened

Lowering the threshold (e.g. to Low) or raising the effort surfaces more patterns, failing a build that previously passed.

How to fix it

Read the report and fix the bug patterns

Run the check locally and address each instance the report names.

Terminal

mvn -B spotbugs:check
# GUI / XML report:
#   mvn spotbugs:gui   (or target/spotbugsXml.xml)

Exclude a false positive with a filter

For a genuine false positive, exclude that specific pattern/class in a filter file - never blanket-disable the plugin.

spotbugs-exclude.xml

<!-- spotbugs-exclude.xml -->
<FindBugsFilter>
  <Match>
    <Class name="com.example.Generated"/>
    <Bug pattern="EI_EXPOSE_REP"/>
  </Match>
</FindBugsFilter>

How to prevent it

Run SpotBugs locally before pushing so patterns are caught early.
Keep exclusions narrow (class + pattern), reviewed, and documented.
Pin the SpotBugs plugin version so the rule set does not shift unexpectedly.