Bundle SpotBugs distribution under tools/spotbugs/

Move from requiring a separate SpotBugs installation to bundling the
full 4.9.3 lib/ directory under tools/spotbugs/. This means developers
can run 'ant spotbugs' with no extra setup. Remove standalone
spotbugs-ant jar from extlib. Simplify GH Action to use bundled copy
(no download or cache needed).

Made-with: Cursor

Author: dbenn

.github/workflows/spotbugs.yml

@@ -13,9 +13,6 @@ jobs:
 
     name: SpotBugs Static Analysis
 
-    env:
-      SPOTBUGS_VERSION: "4.9.3"
-
     steps:
     - uses: actions/checkout@v4
 
@@ -30,23 +27,8 @@ jobs:
         mkdir -p ~/vstar_plugins
         mkdir -p ~/vstar_plugin_libs
 
-    - name: Cache SpotBugs installation
-      id: cache-spotbugs
-      uses: actions/cache@v4
-      with:
-        path: spotbugs-${{ env.SPOTBUGS_VERSION }}
-        key: spotbugs-${{ env.SPOTBUGS_VERSION }}
-
-    - name: Download SpotBugs
-      if: steps.cache-spotbugs.outputs.cache-hit != 'true'
-      run: |
-        wget -q "https://github.com/spotbugs/spotbugs/releases/download/${SPOTBUGS_VERSION}/spotbugs-${SPOTBUGS_VERSION}.tgz"
-        tar xzf "spotbugs-${SPOTBUGS_VERSION}.tgz"
-
     - name: Run SpotBugs
-      run: >
-        ant -noinput -buildfile build.xml spotbugs
-        -Dspotbugs.home=${{ github.workspace }}/spotbugs-${{ env.SPOTBUGS_VERSION }}
+      run: ant -noinput -buildfile build.xml spotbugs
 
     - name: Upload SpotBugs report
       if: always()

build.xml

@@ -503,12 +503,12 @@
 
 	<!-- Static analysis targets -->
 
+	<property name="spotbugs.home" location="tools/spotbugs" />
+
 	<taskdef resource="edu/umd/cs/findbugs/anttask/tasks.properties"
-		classpath="${extlib}/spotbugs-ant-4.9.3.jar" />
+		classpath="${spotbugs.home}/lib/spotbugs-ant.jar" />
 
 	<target name="spotbugs" depends="dist" description="Run SpotBugs static analysis">
-		<fail unless="spotbugs.home"
-			message="spotbugs.home must be set, e.g. ant spotbugs -Dspotbugs.home=/path/to/spotbugs-4.9.3" />
 		<property name="spotbugs.report" location="${test_report}/spotbugs" />
 		<mkdir dir="${spotbugs.report}" />
 

extlib/ReadMe.txt

@@ -80,14 +80,13 @@ For line and branch coverage reporting, JaCoCo is used.
     - jacocoant.jar (0.8.14)
     - Eclipse Public License 2.0
 
-For static analysis with SpotBugs, the Ant task jar is included here.
-A full SpotBugs installation (4.9.3+) is required and its path must
-be provided via -Dspotbugs.home=... when running the Ant target.
-See https://spotbugs.github.io for installation.
+For static analysis with SpotBugs, the full distribution is bundled
+under tools/spotbugs/ and used by the spotbugs Ant target. Run with:
+  ant spotbugs
 
-  o SpotBugs static analysis
+  o SpotBugs static analysis (4.9.3)
     - https://spotbugs.github.io
-    - spotbugs-ant-4.9.3.jar
+    - tools/spotbugs/lib/
     - GNU Lesser General Public License, version 2.1
 
 For mutation testing, additional libraries are required.