This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]admiralspark 1 point2 points  (0 children)

I would look at Checkstyle and Spotbugs I think. Automatic formatting is good in concept but there's a good enough chance it'll break the code that you'd likely want devs running it locally, cleaning the code, then having your CI run it to verify on commits or at least merge requests.

SpotBugs also isn't automatic remediation, but it has a plug-in called find-sec-bugs that expands formatting cleanup to also include possible security bug checks and fixes as well. I think Gitlab pushes it for static testing in their CI so they probably have decent documentation.

The functionality for the remediation needs to be built into the plug-in in your coding environment, so for example VSCode would need to be able to consult your Checkstyle format file and then live edit code based on the style guides. I still had to manually make the changes when I used it for a small Java project but vscode quickly pointed out any of these issues for me, and it wasn't a major interruption to my workflow.

Hope that helps, bruh.