Springboot Verification

affaan-m/ECC/skills/springboot-verification

作者 affaan-mef648e01899ba3e8dc6371642deaaf64b4477775无许可证275K 个星标收录于 2026年10月9日更新于 2026年10月9日仓库4天前更新

Run the full Spring Boot verification loop — Maven or Gradle build, SpotBugs, PMD, and Checkstyle static analysis, unit and Testcontainers integration tests with JaCoCo coverage, OWASP dependency and secret scans, and diff review — producing a pass/fail readiness report. Use when preparing a Spring Boot pull request, validating coverage thresholds, or running pre-deploy verification.

仅含说明Software Development Security

AI 生成的概览

运行 Spring Boot 验证循环，涵盖构建、静态分析、测试、覆盖率、安全扫描与差异审查。

功能: 该技能引导智能体对 Spring Boot 项目执行六个阶段的验证循环：Maven 或 Gradle 构建、SpotBugs/PMD/Checkstyle 静态分析、单元测试与 Testcontainers 集成测试及 JaCoCo 覆盖率、OWASP 依赖与密钥扫描、可选的格式化，以及 git diff 审查。它提供单元测试、集成测试和 MockMvc API 测试的示例代码。最终产出包含构建、静态、测试、安全和差异状态的通过/未通过就绪报告，并列出待修复问题。
适用场景: 适用于为 Spring Boot 服务提交拉取请求之前、重大重构或依赖升级之后，或面向预发布与生产环境的部署前验证。也适合校验测试覆盖率是否达到阈值。
运行要求: 需要一个使用 Maven 或 Gradle 的 Spring Boot 项目，以及相关插件和工具：SpotBugs、PMD、Checkstyle、JaCoCo、OWASP dependency-check、Testcontainers 及容器运行时，可选 Spotless 和 git-secrets。依赖解析和容器镜像拉取需要网络访问。该技能不附带脚本，仅为说明文档。

Spring Boot Verification Loop

Run before PRs, after major changes, and pre-deploy.

When to Activate

Before opening a pull request for a Spring Boot service
After major refactoring or dependency upgrades
Pre-deployment verification for staging or production
Running full build → lint → test → security scan pipeline
Validating test coverage meets thresholds

Phase 1: Build

If build fails, stop and fix.

Phase 2: Static Analysis

Maven (common plugins):

Gradle (if configured):

Phase 3: Tests + Coverage

Report:

Total tests, passed/failed
Coverage % (lines/branches)

Unit Tests

Test service logic in isolation with mocked dependencies:

java

@ExtendWith(MockitoExtension.class)class UserServiceTest {
  @Mock private UserRepository userRepository;  @InjectMocks private UserService userService;
  @Test  void createUser_validInput_returnsUser() {    var dto = new CreateUserDto("Alice", "[email protected]");    var expected = new User(1L, "Alice", "[email protected]");    when(userRepository.save(any(User.class))).thenReturn(expected);
    var result = userService.create(dto);
    assertThat(result.name()).isEqualTo("Alice");    verify(userRepository).save(any(User.class));  }
  @Test  void createUser_duplicateEmail_throwsException() {    var dto = new CreateUserDto("Alice", "[email protected]");    when(userRepository.existsByEmail(dto.email())).thenReturn(true);
    assertThatThrownBy(() -> userService.create(dto))        .isInstanceOf(DuplicateEmailException.class);  }}

@ExtendWith(MockitoExtension.class)class UserServiceTest {
  @Mock private UserRepository userRepository;  @InjectMocks private UserService userService;
  @Test  void createUser_validInput_returnsUser() {    var dto = new CreateUserDto("Alice", "[email protected]");    var expected = new User(1L, "Alice", "[email protected]");    when(userRepository.save(any(User.class))).thenReturn(expected);
    var result = userService.create(dto);
    assertThat(result.name()).isEqualTo("Alice");    verify(userRepository).save(any(User.class));  }
  @Test  void createUser_duplicateEmail_throwsException() {    var dto = new CreateUserDto("Alice", "[email protected]");    when(userRepository.existsByEmail(dto.email())).thenReturn(true);
    assertThatThrownBy(() -> userService.create(dto))        .isInstanceOf(DuplicateEmailException.class);  }}

Integration Tests with Testcontainers

Test against a real database instead of H2:

java

@SpringBootTest@Testcontainersclass UserRepositoryIntegrationTest {
  @Container  static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16-alpine")      .withDatabaseName("testdb");
  @DynamicPropertySource  static void configureProperties(DynamicPropertyRegistry registry) {    registry.add("spring.datasource.url", postgres::getJdbcUrl);    registry.add("spring.datasource.username", postgres::getUsername);    registry.add("spring.datasource.password", postgres::getPassword);  }
  @Autowired private UserRepository userRepository;
  @Test  void findByEmail_existingUser_returnsUser() {    userRepository.save(new User("Alice", "[email protected]"));
    var found = userRepository.findByEmail("[email protected]");
    assertThat(found).isPresent();    assertThat(found.get().getName()).isEqualTo("Alice");  }}

@SpringBootTest@Testcontainersclass UserRepositoryIntegrationTest {
  @Container  static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16-alpine")      .withDatabaseName("testdb");
  @DynamicPropertySource  static void configureProperties(DynamicPropertyRegistry registry) {    registry.add("spring.datasource.url", postgres::getJdbcUrl);    registry.add("spring.datasource.username", postgres::getUsername);    registry.add("spring.datasource.password", postgres::getPassword);  }
  @Autowired private UserRepository userRepository;
  @Test  void findByEmail_existingUser_returnsUser() {    userRepository.save(new User("Alice", "[email protected]"));
    var found = userRepository.findByEmail("[email protected]");
    assertThat(found).isPresent();    assertThat(found.get().getName()).isEqualTo("Alice");  }}

API Tests with MockMvc

Test controller layer with full Spring context:

java

@WebMvcTest(UserController.class)class UserControllerTest {
  @Autowired private MockMvc mockMvc;  @MockBean private UserService userService;
  @Test  void createUser_validInput_returns201() throws Exception {    var user = new UserDto(1L, "Alice", "[email protected]");    when(userService.create(any())).thenReturn(user);
    mockMvc.perform(post("/api/users")            .contentType(MediaType.APPLICATION_JSON)            .content("""                {"name": "Alice", "email": "[email protected]"}                """))        .andExpect(status().isCreated())        .andExpect(jsonPath("$.name").value("Alice"));  }
  @Test  void createUser_invalidEmail_returns400() throws Exception {    mockMvc.perform(post("/api/users")            .contentType(MediaType.APPLICATION_JSON)            .content("""                {"name": "Alice", "email": "not-an-email"}                """))        .andExpect(status().isBadRequest());  }}

@WebMvcTest(UserController.class)class UserControllerTest {
  @Autowired private MockMvc mockMvc;  @MockBean private UserService userService;
  @Test  void createUser_validInput_returns201() throws Exception {    var user = new UserDto(1L, "Alice", "[email protected]");    when(userService.create(any())).thenReturn(user);
    mockMvc.perform(post("/api/users")            .contentType(MediaType.APPLICATION_JSON)            .content("""                {"name": "Alice", "email": "[email protected]"}                """))        .andExpect(status().isCreated())        .andExpect(jsonPath("$.name").value("Alice"));  }
  @Test  void createUser_invalidEmail_returns400() throws Exception {    mockMvc.perform(post("/api/users")            .contentType(MediaType.APPLICATION_JSON)            .content("""                {"name": "Alice", "email": "not-an-email"}                """))        .andExpect(status().isBadRequest());  }}

Phase 4: Security Scan

bash

# Dependency CVEsmvn org.owasp:dependency-check-maven:check# or./gradlew dependencyCheckAnalyze
# Secrets in sourcegrep -rn "password\s*=\s*\"" src/ --include="*.java" --include="*.yml" --include="*.properties"grep -rn "sk-\|api_key\|secret" src/ --include="*.java" --include="*.yml"
# Secrets (git history)git secrets --scan  # if configured

# Dependency CVEsmvn org.owasp:dependency-check-maven:check# or./gradlew dependencyCheckAnalyze
# Secrets in sourcegrep -rn "password\s*=\s*\"" src/ --include="*.java" --include="*.yml" --include="*.properties"grep -rn "sk-\|api_key\|secret" src/ --include="*.java" --include="*.yml"
# Secrets (git history)git secrets --scan  # if configured

Common Security Findings

# Check for System.out.println (use logger instead)grep -rn "System\.out\.print" src/main/ --include="*.java"
# Check for raw exception messages in responsesgrep -rn "e\.getMessage()" src/main/ --include="*.java"
# Check for wildcard CORSgrep -rn "allowedOrigins.*\*" src/main/ --include="*.java"

# Check for System.out.println (use logger instead)grep -rn "System\.out\.print" src/main/ --include="*.java"
# Check for raw exception messages in responsesgrep -rn "e\.getMessage()" src/main/ --include="*.java"
# Check for wildcard CORSgrep -rn "allowedOrigins.*\*" src/main/ --include="*.java"

Phase 5: Lint/Format (optional gate)

Phase 6: Diff Review

Checklist:

No debugging logs left (System.out, log.debug without guards)
Meaningful errors and HTTP statuses
Transactions and validation present where needed
Config changes documented

Output Template

VERIFICATION REPORT===================Build:     [PASS/FAIL]Static:    [PASS/FAIL] (spotbugs/pmd/checkstyle)Tests:     [PASS/FAIL] (X/Y passed, Z% coverage)Security:  [PASS/FAIL] (CVE findings: N)Diff:      [X files changed]
Overall:   [READY / NOT READY]
Issues to Fix:1. ...2. ...

VERIFICATION REPORT===================Build:     [PASS/FAIL]Static:    [PASS/FAIL] (spotbugs/pmd/checkstyle)Tests:     [PASS/FAIL] (X/Y passed, Z% coverage)Security:  [PASS/FAIL] (CVE findings: N)Diff:      [X files changed]
Overall:   [READY / NOT READY]
Issues to Fix:1. ...2. ...

Continuous Mode

Re-run phases on significant changes or every 30–60 minutes in long sessions
Keep a short loop: mvn -T 4 test + spotbugs for quick feedback

Remember: Fast feedback beats late surprises. Keep the gate strict—treat warnings as defects in production systems.

来源与署名

来源：affaan-m/ECC位于skills/springboot-verification提交ef648e0

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Springboot Verification

Spring Boot Verification Loop

When to Activate

Phase 1: Build

Phase 2: Static Analysis

Phase 3: Tests + Coverage

Unit Tests

Integration Tests with Testcontainers

API Tests with MockMvc

Phase 4: Security Scan

Common Security Findings

Phase 5: Lint/Format (optional gate)

Phase 6: Diff Review

Output Template

Continuous Mode

来源与署名

更多来自 affaan-m/ECC 的技能

Unified Notifications Ops

Verification Loop

Ui To Vue

Unified Memory

Visa Doc Translate

Team Builder

更多Software Development技能

Playground

M5 Onboard

Cardputer Buddy

Web Design Guidelines

Vercel React Native Skills

Vercel React Best Practices