Add SpotBugs exclusion filter for events and json packages

Author: brunoborges

pom.xml

@@ -92,6 +92,14 @@
                         <doclint>none</doclint>
                     </configuration>
                 </plugin>
+                <plugin>
+                    <groupId>com.github.spotbugs</groupId>
+                    <artifactId>spotbugs-maven-plugin</artifactId>
+                    <version>4.9.8.2</version>
+                    <configuration>
+                        <excludeFilterFile>spotbugs-exclude.xml</excludeFilterFile>
+                    </configuration>
+                </plugin>
             </plugins>
         </pluginManagement>
         <plugins>
@@ -445,6 +453,9 @@
                 <groupId>com.github.spotbugs</groupId>
                 <artifactId>spotbugs-maven-plugin</artifactId>
                 <version>4.9.8.2</version>
+                <configuration>
+                    <excludeFilterFile>spotbugs-exclude.xml</excludeFilterFile>
+                </configuration>
             </plugin>
             <!-- TODO/FIXME tag tracker -->
             <plugin>

spotbugs-exclude.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    SpotBugs exclusion filter for the Copilot SDK.
+
+    The 'events' and 'json' packages contain Jackson-deserialized DTOs where
+    returning mutable internal representations (EI_EXPOSE_REP) and storing
+    references to mutable objects (EI_EXPOSE_REP2) is intentional and expected.
+    Making defensive copies would add overhead without meaningful security
+    benefit for these read-only data transfer objects.
+-->
+<FindBugsFilter>
+    <Match>
+        <Package name="com.github.copilot.sdk.events"/>
+        <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
+    </Match>
+    <Match>
+        <Package name="com.github.copilot.sdk.json"/>
+        <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
+    </Match>
+</FindBugsFilter>