SpotBugs reasons about Java bytecode. Pointing it only at source code creates an avoidable coverage gap, while independently scanning source, generated output and compiled classes can create confusing duplicates.
Resolve the build deliberately
Identify the supported build system, exact revision, Java version, modules and output directories. Run the least-privileged, network-bounded build appropriate for the fixture. A failed build is coverage evidence and must not be converted into a successful zero-finding scan.
Keep identities stable
Relate a bytecode observation back to module, class, method and source location. Use rule and semantic location in the finding identity so repeated engine output does not multiply the same issue. Keep source-based SAST findings separate unless correlation evidence establishes that they represent the same condition.
Verify with fixtures
Maintain a positive fixture, negative fixed variant and unsupported-build case. Assert build status, discovered class count, expected finding identity, absence of duplicate report rows and a clear warning when bytecode cannot be produced.
Next step: Add a version-pinned Java fixture to your scanner quality gate.