sonar scanned the repo and reported 536 bugs and 43 security hotspots

[tuhao1020]

Has the community ever done a static scan of this repo?

[trask]

hi @tuhao1020! we use errorprone as our static analysis tool (built into the build) and CodeQL as our security scanning tool (running daily)

[tuhao1020]

Is the difference in scanning rules causing the different results?

[anuraaga]

Hi @tuhao1020 - yes it is a different in the rules and coverage of scanning. It looks like your tool is configured to check for style-related issues such as reusing parameter variables - I would generally recommend not running tools with style-related checks on external repositories as these are not actually bugs but often personal preference. For these in particular, the only way to use byte-buddy (Advice.Local in that snippet) is to use this pattern so it wouldn't be possible to change anyways.

errorprone is our primary checker, which is run on every compilation. You can check out the config here

https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/conventions/src/main/kotlin/otel.errorprone-conventions.gradle.kts#L17

[tuhao1020]

Thanks!