title: Maven Codehaus findbugs plugin "onlyAnalyze" option not working as expected
body: <p><strong>Update for the impatient:</strong> it's simple, use <code>package.-</code> for sub-package scanning instead of <code>package.*</code>, as-per martoe's answer below!</p>
  
  <p>I cannot seem to get <code>onlyAnalyze</code> working for my multi-module project: regardless of what package (or pattern) I set, maven-findbugs-plugin doesn't evaluate sub-packages as I'd expect from passing it packagename.*.</p>
  
  <p>To prove either myself or the plugin at fault (though I always assume it's the former!), I setup a small Maven project with the following structure:</p>
  
  <pre><code>pom.xml
  src/
      main/java/acme/App.java
      main/java/acme/moo/App.java
      main/java/no_detect/App.java
  </code></pre>
  
  <p>which is very simple!</p>
  
  <p>The POM has the following findbugs configuration:</p>
  
  <pre><code>&lt;build&gt;
      &lt;plugins&gt;
          &lt;plugin&gt;
              &lt;groupId&gt;org.codehaus.mojo&lt;/groupId&gt;
              &lt;artifactId&gt;findbugs-maven-plugin&lt;/artifactId&gt;
              &lt;version&gt;2.4.0&lt;/version&gt;
              &lt;executions&gt;
                  &lt;execution&gt;
                      &lt;phase&gt;verify&lt;/phase&gt;
                      &lt;goals&gt;&lt;goal&gt;findbugs&lt;/goal&gt;&lt;goal&gt;check&lt;/goal&gt;&lt;/goals&gt;
                  &lt;/execution&gt;
              &lt;/executions&gt;
              &lt;configuration&gt;
                  &lt;debug&gt;true&lt;/debug&gt;
                  &lt;effort&gt;Max&lt;/effort&gt;
                  &lt;threshold&gt;Low&lt;/threshold&gt;
                  &lt;onlyAnalyze&gt;acme.*&lt;/onlyAnalyze&gt;
              &lt;/configuration&gt;
          &lt;/plugin&gt;
      &lt;/plugins&gt;
  &lt;/build&gt;
  </code></pre>
  
  <p>and every App.java has the following code with two obvious violations:</p>
  
  <pre><code>package acme;
  import java.io.Serializable;
  
  public class App implements Serializable
  {
      private static final class NotSer {
          private String meh = "meh";
      }
  
      private static final NotSer ns = new NotSer();// Violation: not serializable field
  
      public static void main( String[] args )
      {
          ns.meh = "hehehe";// Vilation: unused
          System.out.println( "Hello World!" );
      }
  }
  </code></pre>
  
  <p>Note that <code>no_detect.App</code> has the same content as above, but my expectation is that it wouldn't be evaluated by findbugs because I have the "onlyAnalyze" option set to <code>acme.*</code> which I assume would evaluate <code>acme.App</code> and <code>acme.moo.App</code> and nothing else.</p>
  
  <p>I now execute a <code>mvn clean install</code> to clean, build, test, run findbugs, package, install, which produces the following findbugs report (snipped for brevity) and results in a build failure which is expected because <code>acme.App</code> and <code>acme.moo.App</code>:</p>
  
  <pre><code>&lt;BugInstance category='BAD_PRACTICE' type='SE_NO_SERIALVERSIONID' instanceOccurrenceMax='0'&gt;
  &lt;ShortMessage&gt;Class is Serializable, but doesn't define serialVersionUID&lt;/ShortMessage&gt;
  &lt;LongMessage&gt;acme.App is Serializable; consider declaring a serialVersionUID&lt;/LongMessage&gt;
  &lt;Details&gt;
    &amp;lt;p&amp;gt; This field is never read.&amp;amp;nbsp; Consider removing it from the class.&amp;lt;/p&amp;gt;
  &lt;/Details&gt;
  &lt;BugPattern category='BAD_PRACTICE' abbrev='SnVI' type='SE_NO_SERIALVERSIONID'&gt;&lt;ShortDescription&gt;Class is Serializable, but doesn't define serialVersionUID&lt;/ShortDescription&gt;&lt;Details&gt;
  &lt;BugCode abbrev='UrF'&gt;&lt;Description&gt;Unread field&lt;/Description&gt;&lt;/BugCode&gt;&lt;BugCode abbrev='SnVI'&gt;&lt;Description&gt;Serializable class with no Version ID&lt;/Description&gt;&lt;/BugCode&gt;
  </code></pre>
  
  <p>To summarise: only <code>acme.App</code> is analysed, <code>acme.moo.App</code> isn't (bad) and neither is <code>no_detect.App</code> (good).</p>
  
  <p>I tried with two wildcards in the <code>onlyAnalyze</code> option but that produces a <strong>successful build</strong> but with a findbugs error (<code>Dangling meta character '*'</code> etc).</p>
  
  <p>I tried with <code>onlyAnalyze</code> set to <code>acme.*,acme.moo.*</code> which analyzes all the expected classes (<code>acme.App</code> and <code>acme.moo.App</code>) which means it "works" but not as I expect; i.e. I have to explicitly declare all parent-packages for the classes I want to analyze: that could get large and difficult to maintain on a multi-module project!</p>
  
  <p>Do I have to define every package I want analyzed, or can I declare a wildcard/regex pattern that will do what I want? </p>
  
  <p>I'd rather not use the inclusion/exclusion XML because that requires far more setup and reasoning that I don't currently have time for...</p>