In our relentless pursuit to use all static analysis and code quality tools, we would like to add the Checker Framework to our project. This framework uses annotations and utilities to enhance type checking and reduce potential defects in code.

Here is the built-in Checkers:

• Nullness Checker for null pointer errors
• Initialization Checker to ensure all @nonnull fields are set in the constructor
• Map Key Checker to track which values are keys in a map
• Optional Checker for errors in using the Optional type
• Interning Checker for errors in equality testing and interning
• Called Methods Checker for the builder pattern
• Resource Leak Checker for ensuring that resources are disposed of properly
• Fake Enum Checker to allow type-safe fake enum patterns and type aliases or typedefs
• Tainting Checker for trust and security errors
• Lock Checker for concurrency and lock errors
• Index Checker for array accesses
• Regex Checker to prevent use of syntactically invalid regular expressions
• Format String Checker to ensure that format strings have the right number and type of % directives
• Internationalization Format String Checker to ensure that i18n format strings have the right number and type of {} directives
• Property File Checker to ensure that valid keys are used for property files and resource bundles
• Internationalization Checker to ensure that code is properly internationalized
• Signature String Checker to ensure that the string representation of a type is properly used, for example in Class.forName
• GUI Effect Checker to ensure that non-GUI threads do not access the UI, which would crash the application
• Units Checker to ensure operations are performed on correct units of measurement
• Signedness Checker to ensure unsigned and signed values are not mixed
• Purity Checker to identify whether methods have side effects
• Constant Value Checker to determine whether an expression’s value can be known at compile time
• Reflection Checker to determine whether an expression’s value (of type Method or Class) can be known at compile time
• Initialized Fields Checker to ensure all fields are set in the constructor
• Aliasing Checker to identify whether expressions have aliases
• Must Call Checker to over-approximate the methods that should be called on an object before it is de-allocated
• Subtyping Checker for customized checking without writing any code
• Third-party checkers that are distributed separately from the Checker Framework

Not all of these apply to our project, we can discuss the Checkers here and decide which will be valuable for us. Also, suppression of various Checkers can be a bit different, so we can take this on a case-by-case basis.

1 Checker == 1 PR

As for minimizing/ keeping annotations out of our codebase, we can consider https://checkerframework.org/annotation-file-utilities/#viewing-source, which is a tool to externally store annotations and insert them into source code as needed (such as during execution of Checker).