Phase 05 — Code Quality and Engineering Discipline
Why this phase exists: Apache projects live for decades and are maintained by rotating casts of contributors who have never met. The only way that scales is with automated quality gates that make the bar explicit and measurable. This phase teaches the three-layer quality stack every serious Apache project runs: style enforcement, static analysis, and human review.
What You'll Learn
- How Checkstyle enforces coding conventions across a multi-contributor codebase and why that matters
- How SpotBugs finds likely correctness bugs by analyzing bytecode, not source code
- How to read and act on a SpotBugs report (confidence levels, bug categories, false positives)
- How to write a structured, useful code review comment in the Apache style
- The difference between a style nit and a correctness concern — and which one to raise first
Concepts Covered
| Concept | Where it appears |
|---|---|
Checkstyle rules: ConstantName, UnusedImports, MagicNumber, LineLength, MissingJavadocMethod | Lab 01 |
Maven Checkstyle Plugin — failsOnError, checkstyle.xml, CI integration | Lab 01 |
SpotBugs bug categories: NP_*, EI_EXPOSE_REP, MS_MUTABLE_COLLECTION, DM_NUMBER_CTOR | Lab 02 |
| SpotBugs confidence levels: HIGH / MEDIUM / LOW | Lab 02 |
| Bytecode analysis vs source analysis — what each tool sees | Labs 01–02 |
| Fibonacci hashing — correctness constraints (power-of-two N requirement) | Lab 03 |
| Code review rubric: correctness, tests, API contract, performance, clarity | Lab 03 |
| What makes a -1 review comment vs a suggestion vs a nit | Lab 03 |
Labs
| # | Lab | Primary Artifact | What Student Produces |
|---|---|---|---|
| 01 | Checkstyle Enforcement | FlawedScheduler.java + checkstyle.xml | Green mvn checkstyle:check after fixing all 5 planted violations |
| 02 | SpotBugs Static Analysis | ProductionConfig.java + pom.xml | Clean mvn spotbugs:check after fixing all 4 planted bugs |
| 03 | Code Review | CleverPartitioner.java + failing tests | Written code review; passing test suite after applying fixes |
Deliverables Checklist
-
mvn checkstyle:checkpasses with zero violations in Lab 01 -
git diffofFlawedScheduler.javashows exactly the 5 fixed violations -
mvn spotbugs:checkpasses with zero high-confidence bugs in Lab 02 - You can name the SpotBugs bug category for each of the 4 bugs by memory
-
Lab 03 failing tests pass after your fixes to
CleverPartitioner.java - Lab 03 review document identifies every issue with a clear severity label
Interview Relevance
| Question | Where the answer comes from |
|---|---|
| "What's the difference between Checkstyle and SpotBugs?" | Labs 01–02 |
| "How does SpotBugs detect null dereferences?" | Lab 02 HITCHHIKERS-GUIDE |
| "How do you handle a code review when you disagree with the reviewer?" | Lab 03 |
| "What's binary compatibility and how do code quality tools help maintain it?" | Cross-reference Phase 04 |
| "What would make you block a PR from merging vs just leave a comment?" | Lab 03 |