spring-boot-code-review

Reviews Java 21+ Spring Boot REST API changes and produces severity-ranked, evidence-backed findings.

39|3|Updated Jul 28, 2025
One-click install
npx skills add https://github.com/mzivkovicdev/spring-crud-generator --skill spring-boot-code-review-mzivkovicdev
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: spring-boot-code-review
Source: https://github.com/mzivkovicdev/spring-crud-generator/tree/main/.agents/skills/spring-boot-code-review
Command: npx skills add https://github.com/mzivkovicdev/spring-crud-generator --skill spring-boot-code-review-mzivkovicdev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Reviewing Spring Boot pull requests by hand often misses production risks hidden behind framework behavior—proxies, transactions, JPA fetch plans, security boundaries—while flooding authors with cosmetic nitpicks. This Skill performs a disciplined, read-only review of a diff, commit, or working-tree change and reports only verified, severity-ranked defects. ## Core Features & Use Cases - Risk-ordered review: Traces each change from REST entry points through services, persistence, and external systems, prioritizing security, correctness, concurrency, and data integrity over style. - Evidence-gated findings: Every reported issue includes location, evidence, triggering scenario, production impact, remediation direction, and a verification test—unproven concerns become questions or gaps, not defects. - Owner-skill coordination: Routes each finding to the skill that owns the rule (testing, security, JPA, patterns) instead of inventing standards, and records coverage, revision, and verification gaps. - Use Case: Ask for a review of a pull request that adds a new endpoint with caching; the Skill checks tenant scoping of cache keys, transaction-aware eviction ordering, contract compatibility, and required test boundaries, then delivers a merge-decision-ready report. ## Quick Start Review the current pull request of this Spring Boot project and list any blocking findings with evidence and suggested fixes.

Frequently Asked Questions about spring-boot-code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a Spring Boot pull request for production risks?▼

Request a review of the pull request, diff, or commit and the Skill traces each changed execution path in risk order: security, correctness, transactions, availability, persistence, tests, then maintainability. It reports only evidence-backed findings with severity, impact, and fix direction.

What does a Spring Boot code review check in REST APIs?▼

The review verifies REST contract compatibility, validation bounds, ProblemDetail error behavior, service layering, transaction boundaries, JPA query behavior, security and tenant isolation, cache correctness, and test coverage at each required boundary. Findings are ranked Critical through Low.

Does the code review modify my source code automatically?▼

No, reviews are read-only by default: the Skill inspects source, configuration, tests, and build output without modifying files, running migrations, or merging changes. If you ask to review and fix, it completes the review first, then implements only verified fixes.

Can it review changes involving Redis, WebClient, or messaging?▼

Yes, dedicated review lenses cover caches, outbound HTTP clients, AWS services, messaging, and scheduled jobs. It checks cache key scoping, eviction ordering, retry amplification, delivery semantics, and context propagation across async boundaries.

Why does a review report questions instead of defects?▼

Findings require a reachable trigger, supporting code evidence, and concrete impact; observations missing any of these are classified as questions or verification gaps. This prevents unproven hypotheses and style preferences from being reported as defects.

What are the limitations of an automated Spring Boot review?▼

The review cannot claim a change compiles, passes, or is production-ready without executed checks, and untrusted build code runs only in isolated environments. Missing owner skills or unavailable test infrastructure are reported as explicit coverage gaps.