springboot-verification

Run a phased loop: build with mvn clean verify, static analysis with SpotBugs, PMD, and Checkstyle, tests with JaCoCo coverage, OWASP dependency checks, and a final git diff review. Stop and fix at the first failing phase.

Run mvn test followed by mvn jacoco:report to generate a coverage report, then verify line and branch coverage meets your threshold, typically 80 percent. Gradle projects use ./gradlew test jacocoTestReport instead.

Testcontainers runs tests against a real database like PostgreSQL in a Docker container, matching production behavior more closely than H2. Use @DynamicPropertySource to inject the container's JDBC URL, username, and password into the Spring context.

Run mvn org.owasp:dependency-check-maven:check for Maven or ./gradlew dependencyCheckAnalyze for Gradle to detect CVEs in dependencies. Also grep the source for hardcoded passwords, API keys, and secrets.

Later phases like static analysis and tests depend on a successful compilation, so running them on a broken build wastes time and produces misleading results. Fix build errors first, then proceed through the remaining phases in order.