Java ToolingSAFE

A collection of Agent Skills Standard and Best Practice for Programming Languages, Frameworks that help our AI Agent follow best practies on frameworks and programming laguages

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: java-tooling
description: Configure Maven, Gradle, and static analysis for Java projects. Use for Java-only build and quality tooling such as Spotless, Checkstyle, SpotBugs, SonarLint, JDK versions, and Java service Dockerfiles; defer Kotlin, Android, Flutter, and GitHub Actions-specific configuration.
metadata:
  triggers:
    files:
    - 'pom.xml'
    - 'build.gradle'
    - 'build.gradle.kts'
    - '.sdkmanrc'
    keywords:
    - mvnw
    - gradlew
    - spotbugs
    - checkstyle
    - spotless
    - eclipse-temurin
---
# Java Tooling Standards

## **Priority: P2 (MEDIUM)**


## Implementation Guidelines

- **JDK Setup**: Use **`.sdkmanrc`** or **`.java-version`** to lock project to **LTS Support (17 or 21)**. Configure Gradle toolchain via `java { toolchain { languageVersion = JavaLanguageVersion.of(21) } }` for reproducible builds.
- **Maven & Wrapper**: Use **`pom.xml`** with **`<dependencyManagement>`**. ALWAYS use **`mvnw`** wrapper.
- **Gradle & Catalog**: Prefer **`build.gradle.kts`** (Kotlin DSL) with **`libs.versions.toml`** (Version Catalog). Use **`gradlew`** wrapper.
- **Formatting**: Enforce **Google Style Guide** using **`Spotless`** (`googleJavaFormat()` plugin) or **`Checkstyle`**.
- **Static Analysis**: Integrate **`SpotBugs`** or **`SonarLint`** for deep analysis. Use **`Detekt`** if using Kotlin.
- **Docker**: Use **Multi-stage Dockerfiles**. Use **`eclipse-temurin`** as base image.
- **CI/CD**: Configure **GitHub Actions** or **GitLab CI** to run `mvnw test` or `gradlew build` on every PR.

## Anti-Patterns

- **No Global Installs**: Always use mvnw/gradlew wrappers; never rely on system Maven/Gradle.
- **No Fat Jars**: Prefer layered Docker images over uber-jars for better layer caching.
- **No Snapshots in Prod**: Never use -SNAPSHOT dependency versions in production builds.

## References

- [Gradle Kotlin DSL & Spotless Setup](references/example.md)

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.