springboot-verification

Run a phased loop: build with mvn clean verify, run SpotBugs/PMD/Checkstyle static analysis, execute tests with JaCoCo coverage, scan dependencies with OWASP dependency-check, and review the git diff. Stop and fix at the first failing phase.

Use Testcontainers with @SpringBootTest to spin up a real PostgreSQL container instead of H2. Register the container's JDBC URL, username, and password via @DynamicPropertySource so the repository layer runs against an actual database.

Yes, every phase includes commands for both build tools. Maven uses mvn goals like spotbugs:check and jacoco:report, while Gradle equivalents use tasks like checkstyleMain, test, and jacocoTestReport.

Scan dependencies for CVEs with OWASP dependency-check, grep source for hardcoded passwords and API keys, and check for common findings like System.out.println, raw exception messages in responses, and wildcard CORS origins.

Passing tests only confirm executed paths work; coverage measures which lines and branches ran at all. Untested branches, exception handlers, and configuration classes commonly lower coverage, so target the 80% threshold by adding tests for missed paths.