feat(skills): add Java Spring Boot skills #114
Conversation
Add 6 new skills for Java Spring Boot development: - springboot-patterns: REST API, service layer, caching, async, filters - java-coding-standards: naming, immutability, Optional, streams, exceptions - springboot-tdd: JUnit 5, Mockito, MockMvc, Testcontainers, JaCoCo - springboot-security: Spring Security, validation, CSRF, secrets, headers - springboot-verification: build, static analysis, tests, security scans - jpa-patterns: entity design, N+1 prevention, transactions, pagination These skills mirror the existing TypeScript/Node.js skills but adapted for the Java Spring Boot ecosystem with Spring Boot 3.x and Jakarta EE.
|
Analysis IncompleteUnable to generate skill: Not Found - https://docs.github.com/rest/commits/commits#list-commits Common Reasons
To retry: |
📝 WalkthroughWalkthroughAdds six new Markdown skill documents providing guidelines for Java coding standards, JPA/Hibernate patterns, Spring Boot architecture, Spring Security, TDD practices, and a Spring Boot verification workflow. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@affaan-m Ready for review - adding Java Spring Boot skills to complement the existing TypeScript/Node.js patterns. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@skills/springboot-patterns/SKILL.md`:
- Around line 224-247: The filter currently trusts the X-Forwarded-For header in
RateLimitFilter.doFilterInternal which is spoofable; modify the implementation
and docs to treat X-Forwarded-For as untrusted unless the app is behind known
proxies and a ForwardedHeaderFilter (or equivalent trusted proxy/header
handling) is configured—either read the client IP from request.getRemoteAddr()
by default or only use X-Forwarded-For after verifying the request passed
through trusted proxies, and add a comment in the RateLimitFilter class
explaining the requirement to enable ForwardedHeaderFilter and configure trusted
proxy addresses.
In `@skills/springboot-tdd/SKILL.md`:
- Around line 115-134: The JaCoCo plugin version in the Maven snippet uses
0.8.11; update the <artifactId>org.jacoco:jacoco-maven-plugin</artifactId>
<version> element to 0.8.14 so the snippet reflects the current stable release
compatible with Java 17+ (i.e., replace the version value "0.8.11" with "0.8.14"
in the shown <plugin> block).
🧹 Nitpick comments (3)
skills/springboot-verification/SKILL.md (1)
57-62: Use non-mutating format checks in verification phase.
For a verification gate, preferspotless:check/spotlessCheckto avoid modifying code during the run.🔧 Suggested tweak
- mvvn spotless:apply # if using Spotless plugin - ./gradlew spotlessApply + mvn spotless:check # if using Spotless plugin + ./gradlew spotlessCheckskills/springboot-security/SKILL.md (1)
73-83: Clarify intent for deprecated X-XSS-Protection header.
The.xssProtection(Customizer.withDefaults())syntax is correct for Spring Security 6.x, but the X-XSS-Protection header itself is deprecated by OWASP and modern browsers. Consider being explicit about disabling it—either.xssProtection(xss -> xss.disable())to omit the header entirely, or.xssProtection(xss -> xss.headerValue(XXssProtectionHeaderWriter.HeaderValue.DISABLED))to explicitly sendX-XSS-Protection: 0. Your CSP configuration is the proper XSS protection mechanism.skills/springboot-patterns/SKILL.md (1)
200-221: Migrate to Resilience4j for production-grade external call resilience.This example blocks the caller thread with
Thread.sleep, which degrades request-handling performance in servlet/reactive contexts. Spring Boot 3.x officially recommends Resilience4j (or Spring Cloud CircuitBreaker with Resilience4j) for external calls because it provides non-blocking retry with jitter, circuit breaker, bulkhead isolation, and time limiting in a single pattern.If keeping this simplified pattern, at minimum add jitter (
Math.random()) and cap backoff to avoid cascading failures. However, for production code, reference the Resilience4j Spring Boot 3 integration (viaresilience4j-spring-boot3orspring-cloud-starter-circuitbreaker-resilience4j).
The RateLimitFilter was trusting the X-Forwarded-For header directly, which is spoofable by clients. Changed to use request.getRemoteAddr() which is secure by default and returns the correct client IP when ForwardedHeaderFilter is properly configured. Added documentation explaining: - Why X-Forwarded-For is untrusted by default - Requirements for safely using forwarded headers - How to configure ForwardedHeaderFilter and trusted proxies
|
Analysis IncompleteUnable to generate skill: Not Found - https://docs.github.com/rest/commits/commits#list-commits Common Reasons
To retry: |
Update jacoco-maven-plugin from 0.8.11 to 0.8.14, the current stable release with full Java 17+ compatibility.
|
Analysis IncompleteUnable to generate skill: Not Found - https://docs.github.com/rest/commits/commits#list-commits Common Reasons
To retry: |
2 participants
Type of Change
feat:New featureSummary
Adds 6 new skills for Java Spring Boot development:
Why
Spring Boot is mentioned in CONTRIBUTING.md as a wanted framework contribution. These skills mirror existing TypeScript/Node.js skills for Java developers.
Checklist
Tests pass locally(N/A - markdown only)Validation scripts pass(N/A - markdown only)Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.