fix: address spotbugs migration feedback

Agent-Logs-Url: https://github.com/killbill/killbill-plugin-framework-java/sessions/e93f35fb-7445-444e-8336-2f231ac81095

Co-authored-by: xsalefter <510438+xsalefter@users.noreply.github.com>

Author: Copilot

pom.xml

@@ -137,10 +137,6 @@
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-joda</artifactId>
         </dependency>
-        <dependency>
-            <groupId>com.github.spotbugs</groupId>
-            <artifactId>spotbugs-annotations</artifactId>
-        </dependency>
         <dependency>
             <groupId>com.google.code.findbugs</groupId>
             <artifactId>jsr305</artifactId>
@@ -193,11 +189,6 @@
             <groupId>org.joda</groupId>
             <artifactId>joda-money</artifactId>
         </dependency>
-        <dependency>
-            <groupId>org.kill-bill.commons</groupId>
-            <artifactId>killbill-jooby</artifactId>
-            <version>${killbill-commons.version}</version>
-        </dependency>
         <dependency>
             <groupId>org.jooq</groupId>
             <artifactId>jooq</artifactId>
@@ -304,6 +295,11 @@
             <version>${killbill-commons.version}</version>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.kill-bill.commons</groupId>
+            <artifactId>killbill-jooby</artifactId>
+            <version>${killbill-commons.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.kill-bill.commons</groupId>
             <artifactId>killbill-utils</artifactId>

spotbugs-exclude.xml

@@ -18,4 +18,19 @@
 <FindBugsFilter>
     <Bug pattern="EI_EXPOSE_REP"/>
     <Bug pattern="EI_EXPOSE_REP2"/>
+    <!-- Constructor validates and normalizes input URLs, and the checked exception is part of the public API. -->
+    <Match>
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+        <Class name="org.killbill.billing.plugin.api.payment.PluginHostedPaymentPageFormDescriptor"/>
+    </Match>
+    <!-- Constructor performs DB metadata and schema resolution eagerly, and SQL failures are part of the public API. -->
+    <Match>
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+        <Class name="org.killbill.billing.plugin.dao.PluginDao"/>
+    </Match>
+    <!-- Constructor builds SSL/HTTP client state eagerly, and security setup failures are part of the public API. -->
+    <Match>
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+        <Class name="org.killbill.billing.plugin.util.http.HttpClient"/>
+    </Match>
 </FindBugsFilter>

src/main/java/org/killbill/billing/plugin/api/PluginProperties.java

@@ -33,8 +33,6 @@
 import org.killbill.commons.utils.Strings;
 import org.killbill.commons.utils.collect.Iterables;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-
 public abstract class PluginProperties {
 
     // Last one has precedence
@@ -122,7 +120,6 @@ public static Iterable<PluginProperty> findPluginProperties(final Pattern keyPat
                         .collect(Collectors.toUnmodifiableSet());
     }
 
-    @SuppressFBWarnings("WMI_WRONG_MAP_ITERATOR")
     public static <K, V> List<PluginProperty> buildPluginProperties(@Nullable final Map<K, V> data) {
         if (data == null || data.isEmpty()) {
             return Collections.emptyList();

src/main/java/org/killbill/billing/plugin/util/http/SslUtils.java

@@ -42,9 +42,7 @@ public void checkServerTrusted(final java.security.cert.X509Certificate[] certs,
         }
     }
 
-    private final SSLContext looseTrustManagerSSLContext = looseTrustManagerSSLContext();
-
-    private SSLContext looseTrustManagerSSLContext() {
+    private static SSLContext buildLooseTrustManagerSSLContext() {
         try {
             final SSLContext sslContext = SSLContext.getInstance("TLS");
             sslContext.init(null, new TrustManager[]{new LooseTrustManager()}, new SecureRandom());
@@ -60,11 +58,15 @@ private static class SingletonHolder {
         public static final SslUtils instance = new SslUtils();
     }
 
+    private static class LooseTrustManagerSSLContextHolder {
+        public static final SSLContext instance = buildLooseTrustManagerSSLContext();
+    }
+
     public static SslUtils getInstance() {
         return SingletonHolder.instance;
     }
 
     public SSLContext getSSLContext(final boolean acceptAnyCertificate) throws GeneralSecurityException {
-        return acceptAnyCertificate ? looseTrustManagerSSLContext : SSLContext.getDefault();
+        return acceptAnyCertificate ? LooseTrustManagerSSLContextHolder.instance : SSLContext.getDefault();
     }
 }