spring-boot-reviewer

name	spring-boot-reviewer
description	Review Spring Boot dependency injection, transactions, persistence, security, configuration, Actuator, and migrations.
version	1.0.0
since	2026-08-27
last_modified	2026-08-27
authors	["platform-engineering"]
stability	stable
min_platform_version	{"codex":"unknown","amazon-q":"unknown","antigravity":"unknown","auggie":"unknown","bob":"unknown","claude-code":"unknown","cline":"unknown","codebuddy":"unknown","continue":"unknown","costrict":"unknown","crush":"unknown","github-copilot":"unknown","gitlab-duo":"unknown","factory":"unknown","forgecode":"unknown","opencode":"unknown","openhands":"unknown","cursor":"unknown","roo-code":"unknown","kiro":"unknown","junie":"unknown","gemini-cli":"unknown","iflow":"unknown","kilocode":"unknown","kimi":"unknown","lingma":"unknown","pi":"unknown","qoder":"unknown","qwen":"unknown","windsurf":"unknown","ollama":"unknown"}
deprecated_since	null
replaces	null
supersedes	[]
changelog	[{"version":"1.0.0","date":"2026-08-27","change":"Initial generated production-ready SDLC / DevSecOps skill"}]

Spring Boot Reviewer

Purpose

Review Spring Boot applications for dependency injection correctness, bean lifecycle, transaction boundary design, JPA and Hibernate pitfalls, Spring Security configuration, externalised configuration, actuator security, and Spring Boot 3.x migration readiness. Treat regulatory, security, and operational references as review and evidence guidance, not legal advice.

Goal and behavioral contract

The authoritative Goal and artifact references are defined in descriptor.yaml. Capability boundaries, identity and delegation requirements, tool permissions, data boundaries, invariants, approval requirements, output contract, and operational limits are defined in contract.yaml. MCP/A2A trust boundaries and the reviewed execution closure live in integrations/ and dependencies.yaml; ASPS and assurance requirements live in assurance.yaml.

Treat those declarations as mandatory execution constraints. skcr validates requirements but does not claim verification or enforce them at runtime.

When to use

• Spring Boot best practices decisions, controls, or operating practices need independent review.
• A change affects Spring Boot best practices artifacts such as Spring Boot application configuration, bean definition and injection point, transaction boundary annotation, JPA entity and repository, Spring Security configuration, actuator endpoint exposure setting.
• The user needs evidence-oriented findings for risks such as circular bean dependency causing startup failure, @Transactional on private method or wrong proxy type being bypassed, N+1 query from lazy-loaded JPA association without fetch join, Spring Security permitting all by default after configuration mistake, sensitive actuator endpoint exposed without authentication, application secret stored in application.properties committed to version control.
• Audit, security, operations, or platform stakeholders need a concise readiness position.
• Existing documentation, tickets, tests, or logs must be turned into actionable remediation items.

Operating model

1. Identify the relevant Spring Boot best practices artifacts, owners, systems, environments, and review boundary.
2. Compare the available artifacts against expected signals such as Spring Boot startup log and bean graph, transaction rollback or commit log, SQL query count from Hibernate statistics, Spring Security filter chain audit, actuator endpoint list with access control, externalized configuration review against 12-factor principles.
3. Separate confirmed gaps from assumptions, missing evidence, and advisory improvement opportunities.
4. Rate findings by operational, security, compliance, customer, and auditability impact.