$npx -y skills add github/awesome-copilot --skill java-springbootjava-springboot is an agent skill published from github/awesome-copilot, installable through the skills CLI.
| 1 | # Spring Boot Best Practices |
| 2 | |
| 3 | Your goal is to help me write high-quality Spring Boot applications by following established best practices. |
| 4 | |
| 5 | ## Project Setup & Structure |
| 6 | |
| 7 | - **Build Tool:** Use Maven (`pom.xml`) or Gradle (`build.gradle`) for dependency management. |
| 8 | - **Starters:** Use Spring Boot starters (e.g., `spring-boot-starter-web`, `spring-boot-starter-data-jpa`) to simplify dependency management. |
| 9 | - **Package Structure:** Organize code by feature/domain (e.g., `com.example.app.order`, `com.example.app.user`) rather than by layer (e.g., `com.example.app.controller`, `com.example.app.service`). |
| 10 | |
| 11 | ## Dependency Injection & Components |
| 12 | |
| 13 | - **Constructor Injection:** Always use constructor-based injection for required dependencies. This makes components easier to test and dependencies explicit. |
| 14 | - **Immutability:** Declare dependency fields as `private final`. |
| 15 | - **Component Stereotypes:** Use `@Component`, `@Service`, `@Repository`, and `@Controller`/`@RestController` annotations appropriately to define beans. |
| 16 | |
| 17 | ## Configuration |
| 18 | |
| 19 | - **Externalized Configuration:** Use `application.yml` (or `application.properties`) for configuration. YAML is often preferred for its readability and hierarchical structure. |
| 20 | - **Type-Safe Properties:** Use `@ConfigurationProperties` to bind configuration to strongly-typed Java objects. |
| 21 | - **Profiles:** Use Spring Profiles (`application-dev.yml`, `application-prod.yml`) to manage environment-specific configurations. |
| 22 | - **Secrets Management:** Do not hardcode secrets. Use environment variables, or a dedicated secret management tool like HashiCorp Vault or AWS Secrets Manager. |
| 23 | |
| 24 | ## Web Layer (Controllers) |
| 25 | |
| 26 | - **RESTful APIs:** Design clear and consistent RESTful endpoints. |
| 27 | - **DTOs (Data Transfer Objects):** Use DTOs to expose and consume data in the API layer. Do not expose JPA entities directly to the client. |
| 28 | - **Validation:** Use Java Bean Validation (JSR 380) with annotations (`@Valid`, `@NotNull`, `@Size`) on DTOs to validate request payloads. |
| 29 | - **Error Handling:** Implement a global exception handler using `@ControllerAdvice` and `@ExceptionHandler` to provide consistent error responses. |
| 30 | |
| 31 | ## Service Layer |
| 32 | |
| 33 | - **Business Logic:** Encapsulate all business logic within `@Service` classes. |
| 34 | - **Statelessness:** Services should be stateless. |
| 35 | - **Transaction Management:** Use `@Transactional` on service methods to manage database transactions declaratively. Apply it at the most granular level necessary. |
| 36 | |
| 37 | ## Data Layer (Repositories) |
| 38 | |
| 39 | - **Spring Data JPA:** Use Spring Data JPA repositories by extending `JpaRepository` or `CrudRepository` for standard database operations. |
| 40 | - **Custom Queries:** For complex queries, use `@Query` or the JPA Criteria API. |
| 41 | - **Projections:** Use DTO projections to fetch only the necessary data from the database. |
| 42 | |
| 43 | ## Logging |
| 44 | |
| 45 | - **SLF4J:** Use the SLF4J API for logging. |
| 46 | - **Logger Declaration:** `private static final Logger logger = LoggerFactory.getLogger(MyClass.class);` |
| 47 | - **Parameterized Logging:** Use parameterized messages (`logger.info("Processing user {}...", userId);`) instead of string concatenation to improve performance. |
| 48 | |
| 49 | ## Testing |
| 50 | |
| 51 | - **Unit Tests:** Write unit tests for services and components using JUnit 5 and a mocking framework like Mockito. |
| 52 | - **Integration Tests:** Use `@SpringBootTest` for integration tests that load the Spring application context. |
| 53 | - **Test Slices:** Use test slice annotations like `@WebMvcTest` (for controllers) or `@DataJpaTest` (for repositories) to test specific parts of the application in isolation. |
| 54 | - **Testcontainers:** Consider using Testcontainers for reliable integration tests with real databases, message brokers, etc. |
| 55 | |
| 56 | ## Security |
| 57 | |
| 58 | - **Spring Security:** Use Spring Security for authentication and authorization. |
| 59 | - **Password Encoding:** Always encode passwords using a strong hashing algorithm like BCrypt. |
| 60 | - **Input Sanitization:** Prevent SQL injection by using Spring Data JPA or parameterized queries. Prevent Cross-Site Scripting (XSS) by properly encoding output. |