pmd

PMD static analysis for Maven/Java

Try it: /maven-quality:pmd payment-service — or say "what's PMD complaining about?".

PMD finds defects and design smells, which is a different job from formatting. Keep it distinct from the codestyle skill: spring-javaformat and Checkstyle decide how code should look, PMD decides whether it is likely wrong.

Defaults below target a project with maven-pmd-plugin bound to validate, producing target/pmd.xml. Adjust module names, phases, and paths to match.

Adjusting for your project

• Maven invocation: examples use the wrapper ./mvnw. Without one, substitute your mvn binary.
• Multi-module: scope with -pl <module>; each module writes its own target/pmd.xml.
• $ARGUMENTS (when present) is either a module name (Steps 1–3) or a rule name to explain and suppress (Step 6).

Step 1: Run it

./mvnw pmd:check -q                    # whole project, fails on violation
./mvnw pmd:check -pl $ARGUMENTS -q     # one module
./mvnw pmd:pmd -q                      # report only, never fails the build

pmd:check re-runs the analysis, so there is no need to run pmd:pmd first. When the build is already wired to validate, ./mvnw validate does the same.

Step 2: Read the report, not the console

The console output truncates and reorders. target/pmd.xml is the whole truth.

The namespace is the trap. The report is namespaced (http://pmd.sourceforge.net/report/2.0.0), so a plain findall("file") silently returns nothing and the report looks clean. Match on local names instead — that also survives PMD changing the namespace between majors:

Stdlib ElementTree is deliberate — these skills add no dependencies. It refuses external entities outright, so XXE does not apply; it is susceptible to entity- expansion blowup, which is irrelevant for a file your own build just wrote. If you ever point this at a report from an untrusted source, use defusedxml instead.

import xml.etree.ElementTree as ET, sys, collections, pathlib

def local(el):                      # '{ns}violation' -> 'violation'
    return el.tag.rsplit('}', 1)[-1]

rows = []
for report in pathlib.Path('.').glob('**/target/pmd.xml'):
    for f in ET.parse(report).getroot():
        if local(f) != 'file':
            continue
        name = f.get('name', '').split('/src/main/java/')[-1]
        for v in f:
            if local(v) != 'violation':
                continue
            rows.append((int(v.get('priority', 5)), v.get('rule'),
                         v.get('ruleset'), name, v.get('beginline'),
                         ' '.join((v.text or '').split())))

if not rows:
    print('  no violations'); sys.exit()
print(f'  {len(rows)} violations\n')
for rule, n in collections.Counter(r[1] for r in rows).most_common():
    pri = min(r[0] for r in rows if r[1] == rule)
    print(f'  p{pri}  {n:>4}  {rule}')