There are three top players for static code analysis, namely
- Findbug: All standards violations & logical issues are pointed here along with the requested CC issues.
- PMD: All standards violation issues are pointed here along with CC again.
- Checkstyle: All standards violations along with code formatting issues.
My suggestion one should always have zero Findbug issues as, apart from standard violations, the logical issues pointed by it is class apart.
Sonar is a good tool but it has too much dependency to manage, and the setup is also not very straightforward. On the contrary, one can put Findbug, PMD & Checkstyle checks in place on respective project POMs only, and can even configure it to terminate the build process on any single violation encounter and bind the developer to conform to all standards first before moving ahead with code check-in or build for testing.
Please find below respective Maven plugin details:
<groupId>org.codehaus.mojo</groupId>
<artifactId>findbugs-maven-plugin</artifactId>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-pmd-plugin</artifactId>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>