[petter]

Why

This repo had no handwritten static analysis gate. PHP SDKs fail CI on composer analyse. Maintainers and GitHub Actions now share one command, ./gradlew lint --no-daemon, which runs Error Prone 2.42.0 and NullAway on Java compilation only when the Gradle lint task is requested. ./gradlew build stays the compile-and-package path it is today.

yarn distribute still patches only version in build.gradle.kts. Tool pins live in plugins { id("…") version "…" } and dependencies {}, so they are not a second project-level version =.

Scope

• build.gradle.kts registers lint, depends on classes, and enables Error Prone plus NullAway when lint is in gradle.startParameter.taskNames. Kiota paths matching .*/generated/.* are excluded. Kotlin, if present, is covered by compile only. Detekt is not added.
• gradle.lockfile includes the new errorprone artifacts.
• .github/workflows/validate.yml adds a Static analysis step after Build. The step runs ./gradlew lint --no-daemon. Build is unchanged.
• The optional accessToken field and its accessors on the handwritten configuration class are marked @Nullable so NullAway accepts them. generate.sh is not touched. There is no scripts/analyze wrapper.

Tradeoffs

Error Prone 2.42.0 is the last line that runs on the JDK 17 toolchain. 2.43+ would need JDK 21. Analysis stays off build so the existing CI Build step still means compile, not lint.

Blast Radius

SDK maintainers and the validate workflow gain a new failing step if handwritten Java regresses. Downstream consumers of the published jar see no API change beyond @Nullable on getAccessToken(). Generated Kiota sources still compile and are not judged. A later distribute run can still rewrite generate.sh and the Gradle version strings without removing this gate.

Verification

• First ./gradlew lint --no-daemon failed with NullAway errors on uninitialized optional accessToken. After @Nullable on that field and its accessors, ./gradlew lint --no-daemon exited 0 with 0 findings.
• ./gradlew build --no-daemon exited 0.

Made with Cursor