<!-- pom.xml 中集成 SonarQube Maven 插件 -->
<build>
    <plugins>
        <plugin>
            <groupId>org.sonarsource.scanner.maven</groupId>
            <artifactId>sonar-maven-plugin</artifactId>
            <version>3.9.1.2154</version>
        </plugin>
    </plugins>
</build>

<!-- 執(zhí)行掃描命令 -->
mvn sonar:sonar -Dsonar.login=your_token

// 未使用Optional導(dǎo)致的NPE風(fēng)險(xiǎn)
public String getCityName(User user) {
    return user.getAddress().getCity(); // 若user為null則拋出NPE
}

// 修復(fù)后代碼
public String getCityName(User user) {
    return Optional.ofNullable(user)
                   .map(User::getAddress)
                   .map(Address::getCity)
                   .orElse("Unknown");
}

<!-- pom.xml 中集成 SpotBugs 插件 -->
<plugin>
    <groupId>com.github.spotbugs</groupId>
    <artifactId>spotbugs-maven-plugin</artifactId>
    <version>4.8.3</version>
    <configuration>
        <effort>Max</effort> <!-- 檢查深度：Max > High > Default -->
        <threshold>Low</threshold> <!-- 報(bào)告等級(jí)：Low > Normal > High -->
        <includeFilterFile>spotbugs-security.xml</includeFilterFile>
        <plugins>
            <plugin>
                <groupId>com.h3xstream.findsecbugs</groupId>
                <artifactId>findsecbugs-plugin</artifactId>
                <version>1.12.0</version>
            </plugin>
        </plugins>
    </configuration>
</plugin>

[error] Bug: Null pointer dereference in method 'getCityName' at line 15
[error]   Potential cause: 'user' might be null when calling 'getAddress()'

<!-- pom.xml 中集成 PMD 插件 -->
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-pmd-plugin</artifactId>
    <version>3.16.0</version>
    <configuration>
        <rulesets>
            <ruleset>java-basic</ruleset>
            <ruleset>java-design</ruleset>
            <ruleset>java-unusedcode</ruleset>
        </rulesets>
    </configuration>
</plugin>

// 未使用的局部變量（PMD會(huì)標(biāo)記）
public void processData() {
    String unused = "This is not used"; // PMD警告：UnusedLocalVariable
    System.out.println("Processing...");
}

try {
    // 潛在危險(xiǎn)操作
    String data = fetchDataFromAPI();
    process(data);
} catch (NullPointerException e) {
    // 記錄詳細(xì)的上下文信息
    log.error("NPE occurred while processing data", e);
    // 自定義異常包裝
    throw new DataProcessingException("Failed to process data", e);
}

import io.micrometer.core.instrument.MeterRegistry;
import io.micrometer.core.instrument.Timer;

public class DataProcessor {
    private final Timer timer;

    public DataProcessor(MeterRegistry registry) {
        this.timer = registry.timer("data.processing.time");
    }

    public void process(String data) {
        timer.record(() -> {
            // 業(yè)務(wù)邏輯
            Thread.sleep(100); // 模擬耗時(shí)操作
        });
    }
}

@RestController
@RequestMapping("/defects")
public class DefectController {
    @Autowired
    private DefectService defectService;

    // 提交缺陷報(bào)告
    @PostMapping
    public ResponseEntity<String> submitDefect(@RequestBody Defect defect) {
        defect.setStatus("Open");
        defectService.save(defect);
        return ResponseEntity.ok("Defect reported successfully");
    }

    // 查詢?nèi)毕轄顟B(tài)
    @GetMapping("/{id}")
    public ResponseEntity<Defect> getDefect(@PathVariable Long id) {
        return ResponseEntity.ok(defectService.findById(id));
    }
}

Open → In Progress → Fixed → Verified → Closed

# 初始化bisect
git bisect start

# 標(biāo)記已知的壞版本（包含缺陷）
git bisect bad HEAD

# 標(biāo)記已知的好版本（無(wú)缺陷）
git bisect good v1.0.0

# Git會(huì)自動(dòng)定位到引入缺陷的提交
git bisect run mvn test

# 查看結(jié)果
git bisect log

pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                sh 'mvn clean package'
            }
        }
        stage('Static Analysis') {
            steps {
                sh 'mvn sonar:sonar'
                sh 'mvn spotbugs:check'
                sh 'mvn pmd:check'
            }
        }
        stage('Test') {
            steps {
                sh 'mvn test'
            }
        }
    }
    post {
        failure {
            slackSend channel: '#dev-alerts', message: "Build failed: ${env.BUILD_URL}"
        }
    }
}