Code Quality Tools

Why Code Quality Tools Matter — and the One Thing They Can't Do

Static analysis finds a specific, well-understood class of problem: patterns known in advance to be dangerous — an unclosed stream, a redundant null check, a switch with no default case. These are exactly the mistakes a human reviewer misses because they're boring and repetitive, and exactly what a machine is good at catching before a single reviewer even opens the pull request.

// BEFORE — ships, passes code review, passes unit tests that never
// exercise the failure path
public void exportInvoice(Order order) throws IOException {
    FileOutputStream fos = new FileOutputStream("invoice.pdf");
    fos.write(order.toPdfBytes());
    // Never closed. Leaks a file handle on every single call. A reviewer
    // skimming a 40-line diff misses this constantly — it looks fine.
}

// AFTER — SpotBugs flags OBL_UNSATISFIED_OBLIGATION at build time,
// before a human reviewer is even involved
public void exportInvoice(Order order) throws IOException {
    try (FileOutputStream fos = new FileOutputStream("invoice.pdf")) {
        fos.write(order.toPdfBytes());
    }
}

Static Analysis Tools Overview

SonarQube

SonarQube aggregates bugs, vulnerabilities, code smells, and coverage into tracked metrics over time — its distinguishing value over the other tools here is the history and the dashboard, not a fundamentally different detection engine.

Maven Configuration

<properties>
    <sonar.projectKey>order-service</sonar.projectKey>
    <sonar.organization>shop</sonar.organization>
    <sonar.host.url>https://sonarcloud.io</sonar.host.url>
</properties>

mvn sonar:sonar -Dsonar.token=YOUR_TOKEN

GitHub Actions Integration

name: SonarCloud Analysis
on: [push, pull_request]

permissions:
  contents: read

jobs:
  sonar:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with: { fetch-depth: 0 }
    - uses: actions/setup-java@v4
      with: { java-version: '21', distribution: 'temurin', cache: maven }
    - name: Build and analyze
      env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      run: mvn -B verify sonar:sonar

Quality Gate — and how it stays usable on a legacy codebase

// Default "Sonar way" gate — applied only to NEW code by default,
// not the entire existing codebase
New Code Coverage:          > 80%
New Duplicated Lines:       < 3%
New Maintainability Rating: A
New Security Hotspots:      100% reviewed

Checkstyle

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-checkstyle-plugin</artifactId>
    <version>3.5.0</version>
    <configuration>
        <configLocation>google_checks.xml</configLocation>
        <failsOnError>true</failsOnError>
    </configuration>
    <executions>
        <execution><id>validate</id><phase>validate</phase><goals><goal>check</goal></goals></execution>
    </executions>
</plugin>

Custom Configuration

<module name="Checker">
    <module name="TreeWalker">
        <module name="AvoidStarImport"/>
        <module name="UnusedImports"/>
        <module name="LineLength"><property name="max" value="120"/></module>
        <module name="MethodLength"><property name="max" value="50"/></module>
        <module name="EqualsHashCode"/>
        <module name="MissingSwitchDefault"/>
    </module>
</module>

// VIOLATION — star import
import java.util.*;

// CORRECT
import java.util.List;

// VIOLATION — constant naming
public static final int maxItems = 100;   // should be MAX_ITEMS

PMD

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-pmd-plugin</artifactId>
    <version>3.26.0</version>
    <configuration>
        <rulesets>
            <ruleset>/category/java/bestpractices.xml</ruleset>
            <ruleset>/category/java/errorprone.xml</ruleset>
        </rulesets>
        <failOnViolation>true</failOnViolation>
    </configuration>
    <executions>
        <execution><goals><goal>check</goal></goals></execution>
    </executions>
</plugin>

// EmptyCatchBlock — the most valuable PMD rule for production incidents
try {
    paymentGateway.charge(order);
} catch (Exception e) {
    // PMD: empty catch block — this silently swallows a payment failure
}

// UseCollectionIsEmpty
if (order.getItems().size() == 0) { }   // flagged
if (order.getItems().isEmpty()) { }        // correct

SpotBugs

SpotBugs analyzes compiled bytecode, not source — it catches a different, complementary category of bug from PMD and Checkstyle, including some the compiler itself has already optimized away in ways source-level tools can't see.

<plugin>
    <groupId>com.github.spotbugs</groupId>
    <artifactId>spotbugs-maven-plugin</artifactId>
    <version>4.8.6.6</version>
    <configuration>
        <effort>Max</effort>
        <threshold>Low</threshold>
        <plugins>
            <!-- adds security-focused bug patterns -->
            <plugin>
                <groupId>com.h3xstream.findsecbugs</groupId>
                <artifactId>findsecbugs-plugin</artifactId>
                <version>1.13.0</version>
            </plugin>
        </plugins>
    </configuration>
    <executions>
        <execution><goals><goal>check</goal></goals></execution>
    </executions>
</plugin>

// NP_NULL_ON_SOME_PATH — possible null pointer dereference
public void notify(Customer customer) {
    String email = customer.getEmail();   // customer could be null
    email.toLowerCase();
}

// OBL_UNSATISFIED_OBLIGATION — resource leak (Section 0's example)

// EQ_COMPARETO_USE_OBJECT_EQUALS — compareTo defined but equals() isn't
// consistent with it, breaking any TreeSet/TreeMap usage silently

Error Prone

Error Prone runs as a compiler plugin — its findings fail the javac step itself, which is the earliest possible point in the entire pipeline to stop a known bug pattern.

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-compiler-plugin</artifactId>
    <version>3.13.0</version>
    <configuration>
        <release>21</release>
        <compilerArgs>
            <arg>-Xplugin:ErrorProne</arg>
        </compilerArgs>
        <annotationProcessorPaths>
            <path>
                <groupId>com.google.errorprone</groupId>
                <artifactId>error_prone_core</artifactId>
                <version>2.31.0</version>
            </path>
        </annotationProcessorPaths>
    </configuration>
</plugin>

// StringSplitter — split() takes a REGEX, this is a classic silent trap
"1.2.3".split(".");    // "." matches ANY character — returns an empty array
"1.2.3".split("\\.");  // correct — literal dot

// CollectionIncompatibleType — caught at COMPILE time, not runtime
List<String> skus = new ArrayList<>();
skus.contains(123);   // always false — comparing a List<String> against an Integer

Adopting a Tool on a Legacy Codebase Without Blocking Every PR

Turning on Checkstyle or PMD for the first time on a five-year-old codebase typically surfaces thousands of pre-existing violations — if the build fails on all of them immediately, the tool gets disabled by the end of the week out of sheer necessity. The fix is a baseline: freeze the current violations as accepted, and fail the build only on new ones.

// checkstyle-suppressions.xml — accept existing debt in specific files,
// enforce the rule everywhere else, including new files
<suppressions>
    <suppress checks="MagicNumber" files="LegacyPricingEngine\.java"/>
</suppressions>

# PMD — exclude legacy packages entirely rather than suppress line-by-line
# for a first rollout, then shrink this list over time
<excludes>
    <exclude>**/legacy/**/*.java</exclude>
</excludes>

SonarQube's New Code Quality Gate (Section 2) achieves the same outcome without a maintained suppression file at all — it's generally the least effort path if you're already running SonarQube, since "new code only" is the default behavior, not something you have to configure per rule.

Combining Tools — Give Each One a Clear Job

Running all of these at once without a clear division of labor produces conflicting configuration — Checkstyle and Spotless can easily disagree about brace placement or import order if nobody decided which one owns formatting.

# Run everything in one CI step, in an order that fails fast on the
# cheapest checks first
mvn spotless:check checkstyle:check pmd:check spotbugs:check verify

IDE Integration

// IntelliJ IDEA — SonarLint plugin gives real-time analysis as you type,
// synchronized against the same rules as CI, so nothing surprises you
// only after opening a PR. See "IDEs" for more on IDE-integrated tooling.

See IDEs for how static analysis integrates with each IDE's underlying semantic engine.

Code Formatting — Spotless

<plugin>
    <groupId>com.diffplug.spotless</groupId>
    <artifactId>spotless-maven-plugin</artifactId>
    <version>2.44.0</version>
    <configuration>
        <java>
            <googleJavaFormat><version>1.23.0</version></googleJavaFormat>
            <removeUnusedImports/>
        </java>
    </configuration>
    <executions>
        <execution><goals><goal>check</goal></goals></execution>
    </executions>
</plugin>

# mvn spotless:check — CI enforcement
# mvn spotless:apply — auto-fix locally, the one command a developer
# actually needs to remember

Suppressing False Positives — With Justification, Not Silently

@SuppressFBWarnings(value = "NP_NULL_ON_SOME_PATH",
    justification = "customer is validated non-null by the @Valid annotation upstream")
public void notify(Customer customer) { }

@SuppressWarnings("PMD.AvoidDuplicateLiterals")
public void seedTestData() { }

Best Practices and Common Pitfalls

Interview Questions