How to Run Static Code Analysis in a Maven Project

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

For a practical static-analysis baseline in a Java Maven project, configure Checkstyle for coding conventions, PMD for source-level rules, and SpotBugs for likely defects in compiled bytecode. Pin their plugin versions in your pom.xml, then run ./mvnw clean verify (or mvn clean verify). The checks can fail the build when findings violate the configured rules.

Use this as a starting point, not a universal definition of code quality: teams choose the rules, source coverage, and thresholds they can consistently maintain.

#	Preview	Product	Price
1		Maven: The Definitive Guide	$40.05	Buy on Amazon

What Maven static analysis does

Static analysis examines code without running the application. Maven does not have one built-in static-analysis command; it invokes goals supplied by plugins. Source analyzers inspect source files, while bytecode analyzers inspect compiled class files. Neither category proves that a program is correct or free of defects: findings must be reviewed alongside tests and code review.

A Maven lifecycle phase is a named point in the build sequence. Running verify runs the preceding default lifecycle phases as well, including compilation and tests, and runs goals bound to that phase. These three plugins’ check goals bind to verify by default. The Maven lifecycle guide explains the phase sequence.

#1 Best Overall

Sale

Maven: The Definitive Guide

$40.05

Buy on Amazon

Choose tools for the findings you want

Pin the plugins in your POM

Add the following under the project’s top-level <project> element. The versions below match the official plugin documentation checked on September 24, 2026; they are dated examples, not a guarantee that they will remain the newest releases. Check the Checkstyle, PMD, and SpotBugs documentation when choosing or updating versions.

<properties>
  <maven-checkstyle-plugin.version>3.6.0</maven-checkstyle-plugin.version>
  <maven-pmd-plugin.version>3.28.0</maven-pmd-plugin.version>
  <spotbugs-maven-plugin.version>4.10.4.1</spotbugs-maven-plugin.version>
</properties>

<build>
  <plugins>
    <plugin>
      <groupId>org.apache.maven.plugins</groupId>
      <artifactId>maven-checkstyle-plugin</artifactId>
      <version>${maven-checkstyle-plugin.version}</version>
      <configuration>
        <configLocation>checkstyle.xml</configLocation>
      </configuration>
      <executions>
        <execution>
          <id>checkstyle</id>
          <phase>verify</phase>
          <goals><goal>check</goal></goals>
        </execution>
      </executions>
    </plugin>

    <plugin>
      <groupId>org.apache.maven.plugins</groupId>
      <artifactId>maven-pmd-plugin</artifactId>
      <version>${maven-pmd-plugin.version}</version>
      <executions>
        <execution>
          <id>pmd</id>
          <phase>verify</phase>
          <goals><goal>check</goal></goals>
        </execution>
      </executions>
    </plugin>

    <plugin>
      <groupId>com.github.spotbugs</groupId>
      <artifactId>spotbugs-maven-plugin</artifactId>
      <version>${spotbugs-maven-plugin.version}</version>
      <executions>
        <execution>
          <id>spotbugs</id>
          <phase>verify</phase>
          <goals><goal>check</goal></goals>
        </execution>
      </executions>
    </plugin>
  </plugins>
</build>

For Checkstyle, configLocation selects the project’s ruleset; add and maintain the referenced checkstyle.xml in the project. The explicit executions show that checks run at verify. They may be omitted if you are comfortable relying on the plugins’ default lifecycle bindings. The Checkstyle, PMD, and SpotBugs check-goal documentation describes their behavior.

Run the checks and read the result

1. From the directory containing the project’s pom.xml, run ./mvnw clean verify. On Windows, use mvnw.cmd clean verify. If the repository has no Maven Wrapper, run mvn clean verify. The wrapper uses the Maven distribution selected in .mvn/wrapper/maven-wrapper.properties and may download it if needed; see the Maven Wrapper guide.

   ×

   Recommended Free Tools

   Windows Errors? Fix Them Before They Spread

   Fix My PC Now →Free scan · no reinstall

   Outdated Drivers Are Slowing You Down

   Scan My Drivers Free →Free scan · exact hardware match

   PC Slower Than It Used to Be?

   Run a Free PC Scan →Free scan · Windows 10 & 11
   Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

2. Review the console output for each plugin. A finding normally identifies a rule or pattern and the affected source location. A failed check means a configured rule or threshold was not met; it does not by itself establish that an application defect occurs at runtime.

3. If the failure occurs before analysis, diagnose it as a build or configuration problem instead. For example, SpotBugs needs compiled classes. Its documented default class directory is ${project.build.outputDirectory}; a compilation failure must be fixed before bytecode analysis can run. See the SpotBugs check goal.

To isolate one analyzer after configuring its plugin, invoke its check goal directly:

./mvnw checkstyle:check
./mvnw pmd:check
./mvnw compile spotbugs:check
./mvnw pmd:cpd-check

The compile step in the SpotBugs example ensures class files exist. Direct goal invocations help narrow down which analyzer is responsible for a failure; the full lifecycle command is the better check that the configured project build works end to end.

Generate reports when console output is not enough

Check goals enforce rules; report goals create reports. Checkstyle provides checkstyle:checkstyle, PMD provides pmd:pmd and pmd:cpd, and SpotBugs report configuration is documented for the reporting section of the POM. Goal details are available in the Checkstyle, PMD, and SpotBugs documentation.

For an HTML project site, configure the relevant reports and run mvn site. A check goal alone should not be mistaken for a request to produce a browsable report. Report output and locations depend on the plugin configuration; consult the relevant report-goal documentation rather than assuming every plugin writes to the same place.

Tune the rules and source coverage deliberately

Set rules the team will maintain

Start with a shared ruleset, review the findings it produces, and adjust it deliberately. A plugin’s default rules are not an industry-wide definition of correctness. When a finding is valid, fix the code; when the rule does not fit the project, change the shared configuration or use a justified suppression. Avoid broad suppressions that hide unrelated issues.

Account for tests and generated code

Decide explicitly whether tests are in scope. Checkstyle documents includeTestSourceDirectory in its FAQ. PMD supports includeTests and source includes/excludes in its PMD goal configuration. Apply appropriate include or exclude configuration if generated sources should not be checked; the right paths depend on how the project creates them.

Match the Java language level

For PMD, set targetJdk to match the Java source level where appropriate, and confirm that the PMD analyzer version supports the syntax used by the project. A language-level mismatch can cause parse errors that are not findings about code quality. The PMD goal and Java support page document these settings and version-specific support.

Adopt checks in a project with existing violations

If a legacy project has many findings, establish a reviewed baseline or staged adoption policy rather than silently disabling checks. Keep new or changed code under the agreed standard and make exceptions visible. For SpotBugs, settings such as maxAllowedViolations alter whether findings fail the check; document any relaxed threshold and revisit it. See the SpotBugs check parameters.

Run analysis in a multi-module project

When Maven runs a lifecycle phase in a multi-module reactor, it processes the participating projects. A plugin execution in the parent build can therefore apply to modules, but a report produced for one project is not automatically a consolidated reactor report. Where available, use aggregate report or check goals for consolidated output: PMD documents separate aggregate goals, and SpotBugs documents spotbugs:spotbugs-aggregate. See the PMD goal list and SpotBugs FAQ. Configure and verify aggregation for the project’s module layout rather than assuming a root-module report includes every module.

Make the same checks part of CI

Run the same wrapper command in continuous integration that developers use locally: ./mvnw clean verify (or the Windows wrapper equivalent). Keep plugin versions and rulesets in version control so local and CI builds evaluate the same agreed configuration. Treat a failed check as a build signal: inspect the rule and location, then fix the code, make a reviewed ruleset change, or document a narrow exception. Do not raise thresholds or disable a plugin merely to make a failing build green without agreeing on what that changes.

Troubleshoot common failures

• Compilation fails: Fix compilation first. SpotBugs analyzes compiled output, so it cannot provide a normal bytecode analysis when compilation has not produced classes. See the SpotBugs check goal.

• PMD cannot parse the source: Check that the configured Java level matches the project and that the chosen PMD release supports its syntax. See PMD Java support.

• The check fails with findings: Use the reported rule, file, and line to decide whether to fix the code, refine the shared ruleset, or add a justified suppression. A finding is not automatically a confirmed runtime defect.

• No HTML report is available: Run the report goal or configure reporting and use the site lifecycle; a check goal’s purpose is enforcement. Check the Checkstyle FAQ, PMD usage guide, or SpotBugs usage guide for its reporting setup.

  ×

  What’s actually slowing this PC down?

  Pick the symptom - the matching free tool is one click away.

  Crashes & glitchesFree fix →Outdated driversFree fix →System errors & instabilityFree fix →Junk files & broken settingsFree fix →
  Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

• The plugin cannot run with the selected environment: Verify the chosen plugin’s Maven and Java requirements. The SpotBugs Maven Plugin project documents Java 11 or later and Maven 3.6.3 or later for analysis: SpotBugs Maven Plugin project.

• Repeated PMD analysis is slow: PMD supports an analysis cache, but it helps only when its cache file persists between runs. See the PMD goal documentation.

  Quick Recap

  SaleBestseller No. 1

  

  Maven: The Definitive Guide

  $40.05

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.