Sonar-findbugs artifacts part of target folder

[Naseem-Banu-prog]

Hello,

We are using the Findbugs plugin v3.11.0 hosted in github. When we build the code using the Jenkins, the fb-contrib jar(which is a dependency of Sonar Findbugs plugin as per https://github.com/spotbugs/sonar-findbugs/blob/master/pom.xml ) is seen as part of maven target folder.

Our understanding is that sonar scan is run after the final artifact is generated. How does this fb-contrib jar/findsecbugs-plugin.jar is making it to target folder? we got a security flag for it. Please advise.

[gtoison]

Sorry for the belated answer, I recently started maintaining the project.
I believe that this is due to #278 and should be solved in the newer versions of the plugin

[gtoison]

This is actually the same issue as #128
Unfortunately I've not been able to locate the cause so far
I'll close this issue now and you can follow #128