[close #415] add spotbugs in github actions (#502)

Co-authored-by: ti-srebot <66930949+ti-srebot@users.noreply.github.com>

.github/workflows/spotbugs.yml

@@ -0,0 +1,23 @@
+name: Spotbugs
+on: [push]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up JDK 1.8
+        uses: actions/setup-java@v1
+        with:
+          java-version: 1.8
+      - uses: actions/cache@v1
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+      - name: Build with Maven
+        run: mvn -B verify spotbugs:spotbugs -Dmaven.test.skip=true
+      - uses: jwgmeligmeyling/spotbugs-github-action@v1
+        with:
+          path: "**/spotbugsXml.xml"

dev/spotbugs-include.xml

@@ -5,5 +5,12 @@
         <Not>
             <Package name="~org\.tikv\.common\.parser.*"/>
         </Not>
+        <Not>
+            <Or>
+                <Bug pattern="EI_EXPOSE_REP"/>
+                <Bug pattern="EI_EXPOSE_REP2"/>
+            </Or>
+        </Not>
+        <Rank value="1"/>
     </Match>
 </FindBugsFilter>

pom.xml

@@ -608,6 +608,11 @@
                 <groupId>com.github.spotbugs</groupId>
                 <artifactId>spotbugs-maven-plugin</artifactId>
                 <version>4.5.2.0</version>
+                <configuration>
+                    <includeFilterFile>dev/spotbugs-include.xml</includeFilterFile>
+                    <xmlOutput>true</xmlOutput>
+                    <failOnError>false</failOnError>
+                </configuration>
                 <dependencies>
                     <!-- overwrite dependency on spotbugs if you want to specify the version of spotbugs -->
                     <dependency>