build: add SpotBugs plugin and fix all reported findings

Add the SpotBugs Maven plugin (effort=Max, threshold=Medium) with a
`check` execution bound to the `verify` phase across all modules, plus a
documented `spotbugs-exclude.xml` for intentional/false-positive findings.

Real bug fixes:

- ExecutorServiceManager: synchronize start()/stop() so `started` and
  `configurationService` are accessed consistently with the already-locked
  lazyInitWorkflowExecutorService() (IS2_INCONSISTENT_SYNC,
  AT_STALE_THREAD_WRITE_OF_PRIMITIVE).
- AbstractEventSourceHolderDependentResource: make `isCacheFillerEventSource`
  volatile (written under lock, read from reconcile threads).
- ManagedInformerEventSource: make `cache` and `controllerConfiguration`
  volatile (assigned under lock in start(), read lock-free).
- AbstractOperatorExtension: the builder's `namespaceDeleteTimeout` was
  configurable but never plumbed into the extension, so the namespace
  deletion timeout always used the default. Threaded it through the
  constructors of both LocallyRunOperatorExtension and
  ClusterDeployedOperatorExtension.
- MicrometerMetrics.addMetadataTags(): guard against null `metadata`, which
  incrementCounter() already tolerates (latent NPE, NP_NULL_PARAM_DEREF).
- Bootstrapper.addTemplatedFile(): close the Writer via try-with-resources
  and write as UTF-8 (OBL_UNSATISFIED_OBLIGATION, DM_DEFAULT_ENCODING).

Default-encoding fixes (DM_DEFAULT_ENCODING), all pinned to UTF-8:

- LocallyRunOperatorExtension CRD apply/delete byte conversions.
- AccumulativeMappingWriter reader and PrintWriter.
- ClassMappingProvider InputStreamReader.
- sample mysql-schema Secret/Schema Base64 encode/decode.
- sample tomcat-operator WebappReconciler ByteArrayOutputStream.toString().

Sample cleanups:

- TomcatReconciler: avoid unbox-then-rebox in a log argument
  (BX_UNBOXING_IMMEDIATELY_REBOXED).
- OperationsSampleOperator: make the config path overridable via the
  CONFIG_PATH env var instead of a hardcoded absolute path
  (DMI_HARDCODED_ABSOLUTE_FILENAME).

Suppressed in spotbugs-exclude.xml (intentional / false positives):
EI_EXPOSE_REP(2) and CT_CONSTRUCTOR_THROW project-wide, plus DM_EXIT in
LeaderElectionManager, NP_BOOLEAN_RETURN_NULL in BooleanWithUndefined,
EQ_DOESNT_OVERRIDE_EQUALS in GroupVersionKindPlural, and
SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR in
SSABasedGenericKubernetesResourceMatcher and ConfigLoader.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: csviri

bootstrapper-maven-plugin/src/main/java/io/javaoperatorsdk/boostrapper/Bootstrapper.java

@@ -18,6 +18,7 @@
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
@@ -132,9 +133,10 @@ private void addTemplatedFile(
               targetDir == null ? projectDir : targetDir,
               targetFileName == null ? fileName : targetFileName);
       FileUtils.forceMkdir(targetFile.getParentFile());
-      var writer = new FileWriter(targetFile);
-      mustache.execute(writer, values);
-      writer.flush();
+      try (var writer = new FileWriter(targetFile, StandardCharsets.UTF_8)) {
+        mustache.execute(writer, values);
+        writer.flush();
+      }
     } catch (IOException e) {
       throw new RuntimeException(e);
     }

micrometer-support/src/main/java/io/javaoperatorsdk/operator/monitoring/micrometer/MicrometerMetrics.java

@@ -277,7 +277,8 @@ private void addMetadataTags(
       addTagOmittingOnEmptyValue(NAMESPACE, resourceID.getNamespace().orElse(null), tags, prefixed);
     }
     addTag(SCOPE, getScope(resourceID), tags, prefixed);
-    final var gvk = (GroupVersionKind) metadata.get(Constants.RESOURCE_GVK_KEY);
+    final var gvk =
+        metadata == null ? null : (GroupVersionKind) metadata.get(Constants.RESOURCE_GVK_KEY);
     if (gvk != null) {
       addGVKTags(gvk, tags, prefixed);
     }

operator-framework-core/src/main/java/io/javaoperatorsdk/operator/api/config/ExecutorServiceManager.java

@@ -132,7 +132,7 @@ public ScheduledExecutorService scheduledExecutorService() {
     return scheduledExecutorService;
   }
 
-  public void start(ConfigurationService configurationService) {
+  public synchronized void start(ConfigurationService configurationService) {
     if (!started) {
       this.configurationService = configurationService; // used to lazy init workflow executor
       this.cachingExecutorService = Executors.newCachedThreadPool();
@@ -142,7 +142,7 @@ public void start(ConfigurationService configurationService) {
     }
   }
 
-  public void stop(Duration gracefulShutdownTimeout) {
+  public synchronized void stop(Duration gracefulShutdownTimeout) {
     try {
       log.debug("Closing executor");
       var parallelExec = Executors.newFixedThreadPool(3);

operator-framework-core/src/main/java/io/javaoperatorsdk/operator/processing/dependent/AbstractEventSourceHolderDependentResource.java

@@ -36,7 +36,7 @@ public abstract class AbstractEventSourceHolderDependentResource<
 
   private T eventSource;
   private final Class<R> resourceType;
-  private boolean isCacheFillerEventSource;
+  private volatile boolean isCacheFillerEventSource;
   protected String eventSourceNameToUse;
 
   @SuppressWarnings("unchecked")

operator-framework-core/src/main/java/io/javaoperatorsdk/operator/processing/event/source/informer/ManagedInformerEventSource.java

@@ -61,9 +61,9 @@ public abstract class ManagedInformerEventSource<
         Configurable<C> {
 
   private static final Logger log = LoggerFactory.getLogger(ManagedInformerEventSource.class);
-  private InformerManager<R, C> cache;
+  private volatile InformerManager<R, C> cache;
   private final boolean comparableResourceVersions;
-  private ControllerConfiguration<R> controllerConfiguration;
+  private volatile ControllerConfiguration<R> controllerConfiguration;
   private final C configuration;
   private final Map<String, Function<R, List<String>>> indexers = new HashMap<>();
   protected TemporaryResourceCache<R> temporaryResourceCache;

operator-framework-junit/src/main/java/io/javaoperatorsdk/operator/junit/AbstractOperatorExtension.java

@@ -61,7 +61,7 @@ public abstract class AbstractOperatorExtension
   protected final boolean preserveNamespaceOnError;
   protected final boolean skipNamespaceDeletion;
   protected final boolean waitForNamespaceDeletion;
-  protected final int namespaceDeleteTimeout = DEFAULT_NAMESPACE_DELETE_TIMEOUT;
+  protected final int namespaceDeleteTimeout;
   protected final Function<ExtensionContext, String> namespaceNameSupplier;
   protected final Function<ExtensionContext, String> perClassNamespaceNameSupplier;
 
@@ -74,6 +74,7 @@ protected AbstractOperatorExtension(
       boolean preserveNamespaceOnError,
       boolean skipNamespaceDeletion,
       boolean waitForNamespaceDeletion,
+      int namespaceDeleteTimeout,
       KubernetesClient kubernetesClient,
       KubernetesClient infrastructureKubernetesClient,
       Function<ExtensionContext, String> namespaceNameSupplier,
@@ -90,6 +91,7 @@ protected AbstractOperatorExtension(
     this.preserveNamespaceOnError = preserveNamespaceOnError;
     this.skipNamespaceDeletion = skipNamespaceDeletion;
     this.waitForNamespaceDeletion = waitForNamespaceDeletion;
+    this.namespaceDeleteTimeout = namespaceDeleteTimeout;
     this.namespaceNameSupplier = namespaceNameSupplier;
     this.perClassNamespaceNameSupplier = perClassNamespaceNameSupplier;
   }

operator-framework-junit/src/main/java/io/javaoperatorsdk/operator/junit/ClusterDeployedOperatorExtension.java

@@ -53,6 +53,7 @@ private ClusterDeployedOperatorExtension(
       boolean preserveNamespaceOnError,
       boolean skipNamespaceDeletion,
       boolean waitForNamespaceDeletion,
+      int namespaceDeleteTimeout,
       boolean oneNamespacePerClass,
       KubernetesClient kubernetesClient,
       KubernetesClient infrastructureKubernetesClient,
@@ -65,6 +66,7 @@ private ClusterDeployedOperatorExtension(
         preserveNamespaceOnError,
         skipNamespaceDeletion,
         waitForNamespaceDeletion,
+        namespaceDeleteTimeout,
         kubernetesClient,
         infrastructureKubernetesClient,
         namespaceNameSupplier,
@@ -231,6 +233,7 @@ public ClusterDeployedOperatorExtension build() {
           preserveNamespaceOnError,
           skipNamespaceDeletion,
           waitForNamespaceDeletion,
+          namespaceDeleteTimeout,
           oneNamespacePerClass,
           kubernetesClient,
           infrastructureKubernetesClient,

operator-framework-junit/src/main/java/io/javaoperatorsdk/operator/junit/LocallyRunOperatorExtension.java

@@ -87,6 +87,7 @@ private LocallyRunOperatorExtension(
       boolean preserveNamespaceOnError,
       boolean skipNamespaceDeletion,
       boolean waitForNamespaceDeletion,
+      int namespaceDeleteTimeout,
       boolean oneNamespacePerClass,
       KubernetesClient kubernetesClient,
       KubernetesClient infrastructureKubernetesClient,
@@ -103,6 +104,7 @@ private LocallyRunOperatorExtension(
         preserveNamespaceOnError,
         skipNamespaceDeletion,
         waitForNamespaceDeletion,
+        namespaceDeleteTimeout,
         kubernetesClient,
         infrastructureKubernetesClient,
         namespaceNameSupplier,
@@ -184,7 +186,8 @@ public static void applyCrd(String resourceTypeName, KubernetesClient client) {
   private static void applyCrd(String crdString, String path, KubernetesClient client) {
     try {
       LOGGER.debug("Applying CRD: {}", crdString);
-      final var crd = client.load(new ByteArrayInputStream(crdString.getBytes()));
+      final var crd =
+          client.load(new ByteArrayInputStream(crdString.getBytes(StandardCharsets.UTF_8)));
       crd.serverSideApply();
       appliedCRDs.add(new AppliedCRD.FileCRD(crdString, path));
       Thread.sleep(CRD_READY_WAIT); // readiness is not applicable for CRD, just wait a little
@@ -446,7 +449,10 @@ record FileCRD(String crdString, String path) implements AppliedCRD {
       public void delete(KubernetesClient client) {
         try {
           LOGGER.debug("Deleting CRD: {}", crdString);
-          final var items = client.load(new ByteArrayInputStream(crdString.getBytes())).items();
+          final var items =
+              client
+                  .load(new ByteArrayInputStream(crdString.getBytes(StandardCharsets.UTF_8)))
+                  .items();
           if (items == null || items.isEmpty() || items.get(0) == null) {
             LOGGER.warn("Could not determine CRD name from yaml: {}", path);
             return;
@@ -620,6 +626,7 @@ public LocallyRunOperatorExtension build() {
           preserveNamespaceOnError,
           skipNamespaceDeletion,
           waitForNamespaceDeletion,
+          namespaceDeleteTimeout,
           oneNamespacePerClass,
           kubernetesClient,
           infrastructureKubernetesClient,

operator-framework/src/main/java/io/javaoperatorsdk/operator/config/runtime/AccumulativeMappingWriter.java

@@ -19,6 +19,7 @@
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.PrintWriter;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.stream.Collectors;
@@ -51,7 +52,8 @@ public AccumulativeMappingWriter loadExistingMappings() {
               .getResource(StandardLocation.CLASS_OUTPUT, "", resourcePath);
 
       try (BufferedReader bufferedReader =
-          new BufferedReader(new InputStreamReader(readonlyResource.openInputStream()))) {
+          new BufferedReader(
+              new InputStreamReader(readonlyResource.openInputStream(), StandardCharsets.UTF_8))) {
         final var existingLines =
             bufferedReader
                 .lines()
@@ -81,7 +83,7 @@ public void flush() {
           processingEnvironment
               .getFiler()
               .createResource(StandardLocation.CLASS_OUTPUT, "", resourcePath);
-      printWriter = new PrintWriter(resource.openOutputStream());
+      printWriter = new PrintWriter(resource.openOutputStream(), false, StandardCharsets.UTF_8);
 
       for (Map.Entry<String, String> entry : mappings.entrySet()) {
         printWriter.println(entry.getKey() + "," + entry.getValue());

operator-framework/src/main/java/io/javaoperatorsdk/operator/config/runtime/ClassMappingProvider.java

@@ -19,6 +19,7 @@
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.net.URL;
+import java.nio.charset.StandardCharsets;
 import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.Iterator;
@@ -69,7 +70,8 @@ static <T, V> Map<T, V> provide(final String resourcePath, T key, V value) {
   }
 
   private static List<String> retrieveClassNamePairs(URL url) throws IOException {
-    try (BufferedReader br = new BufferedReader(new InputStreamReader(url.openStream()))) {
+    try (BufferedReader br =
+        new BufferedReader(new InputStreamReader(url.openStream(), StandardCharsets.UTF_8))) {
       return br.lines().collect(Collectors.toList());
     }
   }