I am trying to add SpotBugs to my project specifically for SE_NO_SERIALVERSIONID and after running with effort=max I don't see a single class detected, but we know 10 examples we testing to see if they would get detected... all classes have this pattern
public final class SessionInfo implements Serializable
{
...
}
so we know clearly that the check should have happened but didn't.
Is there a way to see why or to explicitly enable this check?
EDIT:
I am trying to debug why this isn't triggering and see it should looking at the spotbugs source code https://github.com/spotbugs/spotbugs/blob/master/spotbugs/src/main/java/edu/umd/cs/findbugs/detect/SerializableIdiom.java#L410-L413
When I turn on debug logging I see
[spotbugs] Directly implements Serializable: org/apache/cassandra/streaming/SessionInfo
...
[spotbugs] org.apache.cassandra.streaming.SessionInfo
[spotbugs] hasPublicVoidConstructor: false
[spotbugs] superClassHasVoidConstructor: true
[spotbugs] isExternalizable: false
[spotbugs] isSerializable: true
[spotbugs] isAbstract: false
[spotbugs] superClassImplementsSerializable: false
[spotbugs] isGUIClass: false
[spotbugs] isEjbImplClass: false
[spotbugs] isJSPClass: false
Not every variable is logged, but knowing the code being inspected it really should trigger...
In ant I set reportLevel="low", seems that this was getting filtered out