Maven Quality And Coverage

验证：未记录

适用版本: 未记录
验证范围: 尚未登记验证记录。

本文缩写（英文全称与中文含义）

缩写	英文全称／名称	中文含义
CI	Continuous Integration	持续集成
JaCoCo	Java Code Coverage	Java 代码覆盖率工具
PMD	PMD source code analyzer	静态代码分析工具名称，不强行展开为某个全称

Links#

https://www.jacoco.org/jacoco/trunk/doc/maven.html
https://www.jacoco.org/jacoco/trunk/doc/prepare-agent-mojo.html
https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/sonarscanner-for-maven/
https://checkstyle.org/maven.html
https://spotbugs.github.io/spotbugs-maven-plugin/
https://maven.apache.org/surefire/maven-surefire-plugin/

1. Important Points#

quality gates:
    tests pass
    coverage is collected
    static checks pass
    scanner result is visible in CI

rule:
    local build should stay fast
    CI verify stage can run heavier checks

2. JaCoCo#

<plugin>
  <groupId>org.jacoco</groupId>
  <artifactId>jacoco-maven-plugin</artifactId>
  <version>0.8.12</version>
  <executions>
    <execution>
      <goals>
        <goal>prepare-agent</goal>
      </goals>
    </execution>
    <execution>
      <id>report</id>
      <phase>verify</phase>
      <goals>
        <goal>report</goal>
      </goals>
    </execution>
    <execution>
      <id>check</id>
      <phase>verify</phase>
      <goals>
        <goal>check</goal>
      </goals>
      <configuration>
        <rules>
          <rule>
            <element>BUNDLE</element>
            <limits>
              <limit>
                <counter>LINE</counter>
                <value>COVEREDRATIO</value>
                <minimum>0.80</minimum>
              </limit>
            </limits>
          </rule>
        </rules>
      </configuration>
    </execution>
  </executions>
</plugin>

./mvnw clean verify
open target/site/jacoco/index.html

也可以不先把 JaCoCo goal 绑定进 POM，直接在命令行调用。下面的 prepare-agent 先设置测试 JVM 的 argLine，test 才真正运行测试并采集覆盖率，最后 report 读取执行数据生成报告：

./mvnw clean org.jacoco:jacoco-maven-plugin:0.8.12:prepare-agent test org.jacoco:jacoco-maven-plugin:0.8.12:report

mvn clean org.jacoco:jacoco-maven-plugin:0.8.6:prepare-agent 也符合“完整插件坐标加 goal”的命令格式，但单独执行到这里不会产生测试覆盖率报告。已有自定义 Surefire argLine 时，要确保保留 JaCoCo 写入的参数；长期在 CI 中使用时，通常把插件版本和执行阶段写入 POM。

3. JaCoCo Multi Module#

<execution>
  <id>report-aggregate</id>
  <phase>verify</phase>
  <goals>
    <goal>report-aggregate</goal>
  </goals>
</execution>

report-aggregate:
    aggregator module 生成跨模块 coverage report

4. SonarQube#

./mvnw -B clean verify sonar:sonar -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN" -Dsonar.projectKey=order-api

<properties>
  <sonar.coverage.jacoco.xmlReportPaths>
    target/site/jacoco/jacoco.xml
  </sonar.coverage.jacoco.xmlReportPaths>
</properties>

覆盖率报告不等于质量门禁；CI 必须执行实际检查并在不达标时失败，分析平台 token 从 Secret 注入。

SonarQube:
    code quality and security analysis platform
    token must come from CI secret

5. Checkstyle#

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-checkstyle-plugin</artifactId>
  <version>3.4.0</version>
  <configuration>
    <configLocation>checkstyle.xml</configLocation>
  </configuration>
  <executions>
    <execution>
      <phase>verify</phase>
      <goals>
        <goal>check</goal>
      </goals>
    </execution>
  </executions>
</plugin>

6. SpotBugs / PMD#

SpotBugs:
    bytecode-level bug pattern scanner

PMD:
    source-level rules and code smell scanner

./mvnw spotbugs:check
./mvnw pmd:check

7. CI Artifact#

publish:
    target/surefire-reports
    target/failsafe-reports
    target/site/jacoco
    SonarQube analysis link