Release SpotBugs 3.1.0 about spotbugs HOT 48 CLOSED

I'm done with my tests. Nothing special came up.

• I tested SpotBugs on various version of the Spring Framework and its components. (Smoke test)
• I tested SpotBugs with FindSecurityBugs 1.6.0
• I ran SpotBugs + FSB on Groovy, Scala, JSP and regular Java bytecode.

from spotbugs.

#313 has been merged. If we have no other request, I will release RC5.

from spotbugs.

OK, looks like we've managed to merge everything!

The 3.1.0 release is tagged ( 11c9895) , and I think @KengoTODA will create the github release tomorrow, because it is the date we wrote in release notes :o) . Is that right, Kengo?

@hazendaz, @KengoTODA : as usually I'm unsure about maven stuff. If I recall it right, it will be automatically deployed on the tag, but it would be nice if you could confirm it is there.

Eclipse stable update site contains already 3.1.0 plugin.

As discussed earlier, we plan to have two branches - one for 3.1.x maintenance and master will be for 4.0.0. Please consider this while fixing bugs.

There is now a wiki for the project and Kengo started already the roadmap for 4.0.0 - feel free to add your items - https://github.com/spotbugs/spotbugs/wiki/Roadmap.

With all this, I guess we have a first release!

from spotbugs.

3.1.0 available on Maven Central

from spotbugs.

+1 to release a RC first.

I'd add to the checklist, we should create and check instructions to use spotbugs with existing maven and gradle plugins, see #8 and #15. Updated instructions must be made available on the website's corresponding section.

We can probably do that first with the current snapshot, once we know for sure, make RC1 release, and make the announcement with full instructions to help people check it out.

We should also make sure to have a proper changelog for people comming from Findbugs 3.0.1. We did fix several issues affecting that version...

from spotbugs.

I think we are pretty close to a RC4: https://github.com/spotbugs/spotbugs/milestone/1
we need:

• fix Eclipse plugin to offer itself as an update to old one #209 , @sewe is working on that
• integrate 2 PR's for compatibility issues I just found, see #233 and #234
• decide on #6 and #228 if they need to be done before release (done)
• finalize Maven support #8

and after that:

• build RC 4 to pick latest fixes
• rebuild and push the most recent docs version

from spotbugs.

Don't forget to build a new version of the gradle plugin - right now, missing 528410a means we can't test out the RC* versions from Gradle.

from spotbugs.

@ all: I think we should create RC5. The major changes:

• We ship ASM 6 beta
• We changed the maven plugin to be part of the project, I'm not sure if there is something else to work on (see #8).
• Gradle plugin issue #291 seem to be fixed
• We auto-deploy Eclipse plugin builds on every merged commit

So looking on https://github.com/spotbugs/spotbugs/milestone/1, we are done.

WDYT?

from spotbugs.

And let's wait for ASM 6 final (see #373) before the final release.

from spotbugs.

I've updated checklist. Please check.

I'll check how to use findbugs-maven-plugin with spotbugs. It might be hard because Maven doesn't let us exclude direct dependency of plugin.
UPDATE: I write detail of this problem in #8

FYI: I found changelog generator which may help us to generate CHANGELOG. But for 3.1.0 release, we should make it by hands because a part of changes aren't managed by issues nor PR in this repository (findbugs repository has related information I guess).

from spotbugs.

I'm working on making changelog, you can check it at master...KengoTODA:changelog

from spotbugs.

Let's release RC1 after we merge #112.

from spotbugs.

3.1.0-RC1 is now on Maven Central.

http://search.maven.org/#artifactdetails%7Ccom.github.spotbugs%7Cspotbugs%7C3.1.0-RC1%7C

from spotbugs.

Question: what is about Eclipse plugin id, exported packages, contributions and extension point id's. All this still uses old "findbugs" related strings. Changing this is a bigger task, will break (probably) existing clients, not changing this will conflict with "old" findbugs plugin (in the sense that Eclipse used the old "findbugs" plugin will update to the spotbugs once the spotbugs update side will be publicly available and known to the Eclipse).

Do we have a plan here? I'm not saying we need this for 3.1.0 release, but for later may be?

Another point: I'm the "owner" of the marketplace entry for findbugs (https://marketplace.eclipse.org/content/findbugs-eclipse-plugin). So far I've always updated the entry once we did a findbugs release. Since I feel no reason to support findbugs development anymore, should I change the entry to be "spotbugs" plugin and point to the new home? Or should we create a new entry? WDYT?

from spotbugs.

Changing this is a bigger task, will break (probably) existing clients, not changing this will conflict with "old" findbugs plugin

Currently we don't change this, so we can replace (upgrade) findbugs plugin with spotbugs plugin as you said.

But it might be better to recommend users to uninstall & install, because upgrading cannot change the tooltip text of icon to switch perspective at least. We may have another unknown problem. I personally prefer to change Eclipse plugin ID.

from spotbugs.

should I change the entry to be "spotbugs" plugin and point to the new home? Or should we create a new entry?

I personally think that we need to create a new entry,
Because I also think that SpotBugs is a last resort to continue FindBugs in Bill's absence. It's not something to replace FindBugs. Then it's nice to keep entry for FindBugs to welcome Bill's comeback.

It's just my personal opinion, let's keep discussion!

from spotbugs.

[redacted] The observation does not apply to the textui mode.

from spotbugs.

@iloveeclipse I've tried to replace Eclipse Plugin ID, but I failed (built plugin cannot be installed to Eclipse). Here is my change, could you check to find out what I missed?

from spotbugs.

Now you have the right manifest, how exactly do you install and which error do you have?

from spotbugs.

I have following error, but it seems that I need to use Eclipse 3.6.2 instead of 4.4.0. I will retry to build with that.

Built with Eclipse Luna (4.4.0) on OSX 10.11.6

An error occurred while collecting items to be installed
session context was:(profile=epp.package.jee, phase=org.eclipse.equinox.internal.p2.engine.phases.Collect, operand=, action=).
No repository found containing: osgi.bundle,com.github.spotbugs.plugin.eclipse,3.1.0.20170417-1492435293335
No repository found containing: org.eclipse.update.feature,com.github.spotbugs.plugin.eclipse,3.1.0.20170417-1492435293335

from spotbugs.

Helios also has similar problem:

Built with Eclipse Helios (3.6.2) on OSX 10.11.6

An error occurred while collecting items to be installed
session context was:(profile=SDKProfile, phase=org.eclipse.equinox.internal.p2.engine.phases.Collect, operand=, action=).
Artifact not found: osgi.bundle,com.github.spotbugs.plugin.eclipse,3.1.0.20170417-1492436124229.
file:/Users/kengo/Documents/github/spotbugs/eclipsePlugin/build/site/eclipse-candidate/plugins/com.github.spotbugs.plugin.eclipse_3.1.0.20170417-1492436124229.jar
Artifact not found: org.eclipse.update.feature,com.github.spotbugs.plugin.eclipse,3.1.0.20170417-1492436124229.
file:/Users/kengo/Documents/github/spotbugs/eclipsePlugin/build/site/eclipse-candidate/features/com.github.spotbugs.plugin.eclipse_3.1.0.20170417-1492436124229.jar

from spotbugs.

Kendo, I have no time to setup the environment, can you please share the build artifacts (update site zip) you generate out of the build? I don't think the problem is Eclipse version related, I guess something is broken after all restructure work. BTW, was you able to install the plugin before changing plugin name?

from spotbugs.

was you able to install the plugin before changing plugin name?

Yes I could.

I will share the built plugin by email, please check the email from [email protected] (I failed to upload zip file to here, maybe it's too large). Thanks for your help!

from spotbugs.

eclipse-candidate\plugins directory in the zip file contains edu.umd.cs.findbugs.plugin.eclipse_3.1.0.20170417-1492436124229.jar.

The jar name must be com.github.spotbugs.plugin.eclipse_3.1.0.20170417-1492436124229.jar.

Additionaly, I'm not sure if the content of the artifacts.xml is properly generated: it contains such parts like below, where I suspect some variables are still unresolved:

<mappings size='3'> <rule filter='(&amp; (classifier=osgi.bundle))' output='${repoUrl}/plugins/${id}_${version}.jar'/> <rule filter='(&amp; (classifier=binary))' output='${repoUrl}/binary/${id}_${version}'/> <rule filter='(&amp; (classifier=org.eclipse.update.feature))' output='${repoUrl}/features/${id}_${version}.jar'/> </mappings>

from spotbugs.

Thanks, I've updated build.gradle and finally I could install the built plugin.
But its behaviour is not same with previous (it cannot list bugs in Bug Explorer), I'll continue investigation.

Here is current update: master...KengoTODA:fa7ebd6

from spotbugs.

@KengoTODA, I've created issue #155 to work on. See iloveeclipse@720edcb. This should fix eclipse issues you've observed. I'm still fighting with gradle build, so not sure if this works or not, but at least in half-broken debugger it looks OK now.

from spotbugs.

Great, I will check.

from spotbugs.

@iloveeclipse I've confirmed that your branch https://github.com/iloveeclipse/spotbugs/commits/change-eclipse-plugin-id works as expected! Could you propose a PR?

from spotbugs.

I also made a content for SpotBugs Eclipse Plugin in Eclipse Marketplace:
https://marketplace.eclipse.org/content/spotbugs-eclipse-plugin

But its update site URL returns 404 for now.

from spotbugs.

Just created pr #157.

from spotbugs.

In my understanding, we still have one blocker to release 3.1.0:

• Incorrect version in Eclipse Update site (#173)

#89, #130 and #162 are also better to fix/discuss.

I expect that #147 has been solevd by changing Eclispe Plugin ID, but not confirmed by author of that issue (because we haven't publish Eclipse Plugin yet).

from spotbugs.

To ensure that Eclipse update site works, I will release RC3 later.
-> Done: http://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs/3.1.0-RC3/

from spotbugs.

right now, missing 528410a means we can't test out the RC* versions from Gradle.

528410a is merged now.

What else is needed to build Gradle plugin, or let say it differently: who did this before and do we need to upload something to some repo somewhere in the Gradle/maven universe?

from spotbugs.

The plugin is at https://plugins.gradle.org/plugin/com.github.spotbugs, but I'm not sure who built/published the last version on June 10th.

from spotbugs.

If nobody handles releasing RC4, I will handle it but I wish before release we fix javadoc and changelog at least regarding #269 (comment)

from spotbugs.

BTW all the release procedures are listed in https://github.com/spotbugs/spotbugs/blob/master/RELEASE_PROCEDURE.md

About auto release (e.g. ask Travis CI to release if tagged commit was pushed to master), it's possible and we can find many helpful entries:

• https://docs.travis-ci.com/user/encrypting-files/
• https://github.com/making/travis-ci-maven-deploy-skelton
• https://dracoblue.net/dev/uploading-snapshots-and-releases-to-maven-central-with-travis/

I also want to automate uploading zip and tarball to GitHub releases, and it should be supported by https://docs.travis-ci.com/user/deployment/releases/

from spotbugs.

I wish #268 to be fixed before RC4 too.

from spotbugs.

+1 to release RC5. I prefer merging #313 before release, then we can confirm that the deployment to eclipse-candidate site works as expected.

from spotbugs.

I will release RC6 after #337 is merged, please let me know if you have more changes to introduce.

from spotbugs.

Let's wait bcel 6.1 release to close #89 before RC6

from spotbugs.

@KengoTODA
Does MyEclipse 10 supports spotbugs plugin ?

from spotbugs.

@RAKESHNM Not sure. What SpotBugs Eclipse Plugin officially supports is Neon and Oxygen. If MyEclipse 10 is based on them, it probably works.

from spotbugs.

Guys,I've set the deadline for the release to 15 October, see https://github.com/spotbugs/spotbugs/milestone/1.

The only one planned and open item left is maven plugin, see #8. As soon as this one is closed, we schould create the last RC and enter the "quiet" week with no changes except blocker issues or documentation changes. Ideally after this week we would just flip the version and release 3.1.0.

Any objections? I'm too fast?

from spotbugs.

Guys, please check #446. If this is OK, we have RC7 and hopefully next commit will be for 3.1.0 final.

from spotbugs.

Guys, I need your help!

We were very close to release 3.1.0 final, but then I saw that we had two show stoppers:

• we produce errors while parsing module-info.class files (see #408), but we want support Java 9 where this is one of the basics.
• we produced "wrong" versions for "final release" Eclipse plugins (see #472)

I have PR's for both issues - #474 and #473.

• The module-info PR #474 should be safe because it basically doesn't let SpotBugs to look inside module-info.class at all by default. No one in the world needs this yet.
• The Eclipse version PR #473 should be safe because it only affects the Eclipse plugin version string generation.

I personally think both PR's are OK to merge for 3.1.0 final without an extra RC release, and I really want to have the release coming ASAP.

So here is the question: can we merge both PR's and release 3.1.0 without an extra RC build and another delay, or should we create another RC for testing them?

Do you see any other show stoppers?
Should we wait longer before release?

WDYT?

from spotbugs.

Merge them and release :)

from spotbugs.

it is the date we wrote in release notes :o

Sorry it was almost 25th at far east :)

I've updated release page, please check. https://github.com/spotbugs/spotbugs/releases/tag/3.1.0

from spotbugs.

Thanks Kengo. I think we can close this task now.

from spotbugs.