[SpotBugs] Exposed mutable internals & API design (223 findings)

[clrozeboom]

Priority: LOW-MED · 223 findings (10 high-confidence P1) · SpotBugs category 4/5

Returning/storing mutable internals (EI_EXPOSE_REP/EI_EXPOSE_REP2), mutable statics, public primitive attributes, mutable enum fields. For robot code, much of this is accepted practice — and the PA_PUBLIC_PRIMITIVE_ATTRIBUTE findings in config/json/** are intentional (Jackson deserializes public fields). Recommended handling: exclude the config POJO package for these patterns in config/spotbugs/exclude.xml, then review the remainder case-by-case where a defensive copy is genuinely warranted (e.g., arrays/collections handed across subsystem boundaries).

Patterns

• EI_EXPOSE_REP2 — 78 findings
• EI_EXPOSE_REP — 70 findings
• PA_PUBLIC_PRIMITIVE_ATTRIBUTE — 32 findings
• MS_SHOULD_BE_FINAL — 13 findings
• MS_PKGPROTECT — 9 findings
• MS_EXPOSE_REP — 7 findings
• ME_MUTABLE_ENUM_FIELD — 7 findings
• MF_CLASS_MASKS_FIELD — 4 findings
• MS_MUTABLE_ARRAY — 1 finding
• EI_EXPOSE_STATIC_REP2 — 1 finding
• MS_FINAL_PKGPROTECT — 1 finding

High-confidence (P1) findings — start here

• MS_SHOULD_BE_FINAL at org/frc5010/common/arch/WpiNetworkTableValuesHelper.java:23
• MF_CLASS_MASKS_FIELD in org/frc5010/common/drive/SwerveDriveConfig.java
• MF_CLASS_MASKS_FIELD in org/frc5010/common/motors/function/AngularControlMotor.java
• MF_CLASS_MASKS_FIELD in org/frc5010/common/sensors/camera/SimulatedCamera.java
• MS_SHOULD_BE_FINAL at org/frc5010/common/sensors/camera/SimulatedCamera.java:23
• MF_CLASS_MASKS_FIELD in org/frc5010/common/subsystems/AprilTagPoseSystem.java
• MS_SHOULD_BE_FINAL at org/frc5010/common/vision/AprilTags.java:53
• MS_SHOULD_BE_FINAL at org/frc5010/common/vision/AprilTags.java:205
• MS_SHOULD_BE_FINAL at org/frc5010/common/vision/VisionConstants.java:10
• MS_MUTABLE_ARRAY at org/frc5010/common/vision/VisionConstants.java:23

Top files (full list in the triage doc)

• org/frc5010/common/sensors/Controller.java — 15: PA_PUBLIC_PRIMITIVE_ATTRIBUTE×10, EI_EXPOSE_REP×4, EI_EXPOSE_REP2×1
• org/frc5010/common/drive/GenericDrivetrain.java — 13: PA_PUBLIC_PRIMITIVE_ATTRIBUTE×8, EI_EXPOSE_REP2×2, EI_EXPOSE_REP×2, MS_PKGPROTECT×1
• org/frc5010/common/vision/VisionConstants.java — 8: MS_SHOULD_BE_FINAL×7, MS_MUTABLE_ARRAY×1
• org/frc5010/common/arch/GenericRobot.java — 8: MS_PKGPROTECT×3, EI_EXPOSE_REP×3, PA_PUBLIC_PRIMITIVE_ATTRIBUTE×1, EI_EXPOSE_REP2×1
• org/frc5010/common/drive/SwerveDriveConfig.java — 7: EI_EXPOSE_REP2×4, EI_EXPOSE_REP×2, MF_CLASS_MASKS_FIELD×1
• org/frc5010/common/drive/pose/PoseProvider.java — 6: EI_EXPOSE_REP×3, EI_EXPOSE_REP2×3
• org/frc5010/common/drive/swerve/GenericSwerveModuleInfo.java — 6: PA_PUBLIC_PRIMITIVE_ATTRIBUTE×6
• org/frc5010/common/motors/function/GenericFunctionalMotor.java — 6: EI_EXPOSE_REP2×4, EI_EXPOSE_REP×2
• org/frc5010/common/sensors/camera/PhotonVisionPoseCamera.java — 6: EI_EXPOSE_REP2×4, EI_EXPOSE_REP×2
• org/frc5010/common/subsystems/AprilTagPoseSystem.java — 5: EI_EXPOSE_REP2×3, MF_CLASS_MASKS_FIELD×1, EI_EXPOSE_REP×1
• org/frc5010/common/vision/AprilTags.java — 5: MS_SHOULD_BE_FINAL×2, ME_MUTABLE_ENUM_FIELD×2, PA_PUBLIC_PRIMITIVE_ATTRIBUTE×1
• org/frc5010/common/motors/hardware/GenericRevBrushlessMotor.java — 5: EI_EXPOSE_REP×5
• …plus ~83 more files (~135 findings) — see the full table in the triage doc.

Full detail

Complete file:line table: docs/SPOTBUGS_TRIAGE.md (section 4).
Regenerate the report with ./gradlew spotbugsMain → build/reports/spotbugs/main.html.