Add Spring Boot skills for Boot 4 and update OpenAPI generation by jdubois · Pull Request #5081 · github/awesome-copilot

jdubois · 2026-10-14T13:59:18Z

Pull Request Checklist

I have read and followed the CONTRIBUTING.md guidelines.
I have read and followed the Guidance for submissions involving paid services.
My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
The file follows the required naming convention.
The content is clearly structured and follows the example format.
I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
I have run npm start and verified that README.md is up to date.
I am targeting the main branch for this pull request.

Description

Adds a Spring Boot skill set: create-spring-boot-java-project (start.spring.io based, derived from Dr JSkill, see references/PROVENANCE.md), a fuller java-springboot (data, REST, messaging, caching, configuration, AOT), spring-boot-testing, spring-security, spring-observability and spring-boot-4-migration. The 1,500-line Boot 4 migration instruction becomes a skill with a pointer instruction, and springboot.instructions.md is re-scoped. openapi-to-application-code and its agent are updated.

This is part of a series that reorganizes the Java resources for developers doing plain Java first, then Spring Boot or Quarkus on top: (1) java-upgrade, (2) core Java skills, (3) Spring Boot, (4) Quarkus, then a final plugins PR that wires them together. Each PR is independent: skills only reference each other by name and say "if installed". npm run skill:validate, npm run plugin:validate and npm run build pass on each branch. Generated files (docs/README.*) may conflict between the PRs; I will rebase and rebuild as they land.

Type of Contribution

New skill file.
Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.

Additional Notes

Verified on Spring Boot 4.1.1 and 3.5.16 with Maven and Gradle, including Testcontainers, security snippets, native builds and a 3.5 to 4.1 migration. Unverified items (RabbitMQ, Docker Compose at runtime) are flagged in the files.

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

…sting, security, observability, Boot 4 migration) and OpenAPI generation updates Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 041b82be-5972-43b4-b000-870d0d2d9810

github-actions · 2026-10-14T13:59:58Z

🔒 PR Risk Scan Results

Scanned 57 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

github-actions · 2026-10-14T13:59:58Z

🚦 Submission status: 💬 Review in progress

Risk tier: merge-risk:medium — New or substantially changed resource without privileged execution
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access.

Why this tier

Adds 47 file(s), e.g. agents/openapi-to-application-java-spring-boot.agent.md
Changes 5500 lines (low-risk limit is 40)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Skill validation	✅ Passed	Passed · logs
Skill lint (vally)	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs

Review

Approvals: 0/1
Assigned reviewer: not assigned yet — comment /request-review to ask for one
Review target date: not set
Still needed: 1 more approval(s)
No staffed reviewer pool owns these files yet; any reviewer with write access counts as the domain reviewer.

Commands

Command	Who	What it does
`/rerun-checks`	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
`/request-review`	PR author, maintainers	Asks the review rotation to assign a reviewer (adds `needs-reviewer`)

_{Updated for f65ff39 · gate run · This comment is maintained automatically — see submission gate docs.}

github-actions · 2026-10-14T14:01:31Z

🔍 Vally Lint Results

⚠️ Warnings or advisories found

Scope	Checked
Skills	7
Agents	1
Total	8

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	1

Summary

Level	Finding
ℹ️	Vally currently lints SKILL.md content. Agent files were detected but skipped:

Full linter output

### Linting skills/create-spring-boot-java-project
✅ create-spring-boot-java-project (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Linting skills/java-springboot
✅ java-springboot (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Linting skills/openapi-to-application-java-spring-boot
✅ openapi-to-application-java-spring-boot (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Linting skills/spring-boot-4-migration
✅ spring-boot-4-migration (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Linting skills/spring-boot-testing
✅ spring-boot-testing (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Linting skills/spring-observability
✅ spring-observability (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Linting skills/spring-security
✅ spring-security (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Agent files detected (not linted by vally)
ℹ️ Vally currently lints SKILL.md content. Agent files were detected but skipped:
agents/openapi-to-application-java-spring-boot.agent.md

Copilot

🟡 Changes recommended

Several migration examples use unsupported APIs or packages and an invalid Gradle minimum, causing failed builds.

6 open findings

What changed in this PR

Adds a comprehensive Spring Boot 3/4 skill set covering project creation, migration, security, observability, testing, application development, and OpenAPI generation.

Changes:

Adds Spring Boot 4 migration, security, and observability skills.
Expands testing, application-development, scaffolding, and OpenAPI guidance.
Updates related instructions, agent metadata, assets, provenance, and generated indexes.

Knowledge uplift: High—primarily version-specific APIs, migration constraints, and tested build patterns.

File	Description
`skills/spring-security/SKILL.md`	Adds security workflow.
`skills/spring-security/references/testing-security.md`	Adds security testing guidance.
`skills/spring-security/references/review-checklist.md`	Adds review checklist.
`skills/spring-security/references/password-encoding.md`	Documents password encoding.
`skills/spring-security/references/oidc-login-oauth2-client.md`	Covers OIDC and OAuth clients.
`skills/spring-security/references/oauth2-resource-server-jwt.md`	Covers JWT resource servers.
`skills/spring-security/references/method-security.md`	Documents method authorization.
`skills/spring-security/references/csrf-cors-sessions-headers.md`	Covers web protections.
`skills/spring-security/references/actuator-protection.md`	Secures Actuator endpoints.
`skills/spring-observability/SKILL.md`	Adds observability workflow.
`skills/spring-observability/references/tracing-observation.md`	Covers tracing and observations.
`skills/spring-observability/references/metrics.md`	Documents Micrometer metrics.
`skills/spring-observability/references/logging.md`	Covers structured logging.
`skills/spring-observability/references/dumps-and-diagnostics.md`	Documents safe dump handling.
`skills/spring-observability/references/actuator.md`	Covers Actuator configuration.
`skills/spring-boot-testing/SKILL.md`	Expands Boot 3/4 testing guidance.
`skills/spring-boot-testing/references/testcontainers-jdbc.md`	Updates Testcontainers examples.
`skills/spring-boot-testing/references/test-slices-overview.md`	Updates slice examples.
`skills/spring-boot-testing/references/sb4-migration.md`	Refines testing migration notes.
`skills/spring-boot-testing/references/instancio.md`	Updates container syntax.
`skills/spring-boot-testing/references/failsafe-integration-tests.md`	Adds Failsafe guidance.
`skills/spring-boot-testing/references/datajpatest.md`	Updates JPA test examples.
`skills/spring-boot-4-migration/SKILL.md`	Adds migration workflow.
`skills/spring-boot-4-migration/references/11-checklist-pitfalls-resources.md`	Adds final migration checklist.
`skills/spring-boot-4-migration/references/10-kotlin-and-java-build-config.md`	Covers compiler configuration.
`skills/spring-boot-4-migration/references/09-actuator-and-observability.md`	Covers observability migration.
`skills/spring-boot-4-migration/references/08-testing.md`	Covers testing migration.
`skills/spring-boot-4-migration/references/07-web-and-messaging.md`	Covers web and messaging changes.
`skills/spring-boot-4-migration/references/06-configuration-properties.md`	Documents property changes.
`skills/spring-boot-4-migration/references/05-build-and-dependencies.md`	Covers dependency migration.
`skills/spring-boot-4-migration/references/04-core-framework.md`	Covers framework changes.
`skills/spring-boot-4-migration/references/03-jackson-3.md`	Documents Jackson 3 migration.
`skills/spring-boot-4-migration/references/02-starters-and-removed-features.md`	Covers modular starters.
`skills/spring-boot-4-migration/references/01-prerequisites.md`	Defines migration prerequisites.
`skills/openapi-to-application-code/SKILL.md`	Reworks Spring OpenAPI generation.
`skills/java-springboot/SKILL.md`	Expands application-development routing.
`skills/java-springboot/references/rest-api.md`	Adds REST API guidance.
`skills/java-springboot/references/messaging-caching.md`	Adds messaging and caching guidance.
`skills/java-springboot/references/data.md`	Adds Spring Data guidance.
`skills/java-springboot/references/configuration.md`	Adds configuration guidance.
`skills/java-springboot/references/aot-and-startup.md`	Adds startup optimization guidance.
`skills/create-spring-boot-java-project/SKILL.md`	Reworks project scaffolding.
`skills/create-spring-boot-java-project/references/versions.md`	Defines version selection.
`skills/create-spring-boot-java-project/references/spring-boot-4.md`	Summarizes Boot 4 differences.
`skills/create-spring-boot-java-project/references/security.md`	Adds scaffold security defaults.
`skills/create-spring-boot-java-project/references/PROVENANCE.md`	Records source provenance.
`skills/create-spring-boot-java-project/references/logging.md`	Adds logging defaults.
`skills/create-spring-boot-java-project/references/docker.md`	Documents container assets.
`skills/create-spring-boot-java-project/references/database.md`	Adds PostgreSQL defaults.
`skills/create-spring-boot-java-project/references/configuration.md`	Adds scaffold configuration guidance.
`skills/create-spring-boot-java-project/assets/Dockerfile-native-gradle`	Adds Gradle native image.
`skills/create-spring-boot-java-project/assets/Dockerfile-native`	Adds Maven native image.
`skills/create-spring-boot-java-project/assets/Dockerfile-gradle`	Adds Gradle JVM image.
`skills/create-spring-boot-java-project/assets/Dockerfile`	Adds Maven JVM image.
`instructions/springboot.instructions.md`	Rescopes Java Boot instructions.
`docs/README.skills.md`	Registers updated skills.
`docs/README.instructions.md`	Updates instruction index.
`docs/README.agents.md`	Updates agent index.
`agents/openapi-to-application.agent.md`	Specializes the OpenAPI agent.

🧠 Review effort: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

….x pin Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 041b82be-5972-43b4-b000-870d0d2d9810

…r example Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 041b82be-5972-43b4-b000-870d0d2d9810

jdubois · 2026-10-14T14:24:57Z

/request-review

github-actions · 2026-10-14T14:26:03Z

🙋 Added needs-reviewer. Reviewer routing is assigning a reviewer now.

Copilot

🟡 Changes recommended

Several migration examples and both Gradle Docker templates currently fail because of invalid APIs, packages, or optional-file handling.

9 open findings

6 resolved since last review

Previously missed (1)

In code that hasn't changed since last review

Rule incorrectly removes AspectJ starter needed for framework aspects

skills/spring-boot-4-migration/references/02-starters-and-removed-features.md:127

The starter is also required for framework-provided aspects such as Micrometer's @Observed, even when application code declares no org.aspectj.lang.annotation types. This rule would make users remove a dependency required by the new observability skill; mention aspect-based framework features and the observation opt-in property.

🧠 Review effort: Balanced

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f12b6e46-8c36-43b5-8de2-9871e18bf50e

Copilot

🟡 Changes recommended

Unresolved examples can break application startup, authentication, and test initialization, while several migration and observability instructions remain inaccurate.

8 open issues

In a freshly generated app, Boot still creates its default user, but… · New
The Boot 4 keys bind to JsonReadFeature and JsonWriteFeature, which do not contain these… · New
This catalog entry directs a Boot 4 migration onto the Elasticsearch 8 client line instead of… · New
The imported SecurityConfig enables JWT resource-server authentication and requires a… · New
The Boot 3 base class is JsonObjectDeserializer, not JsonValueDeserializer. This migration rule… · New
Replacing null-filtering configuration with .always() reverses its behavior: Boot 4 already skips… · New
A StructuredLoggingJsonMembersCustomizer registered only as a Spring bean is not discovered by… · New
Messaging observations are not enabled automatically by adding the tracing dependencies. For… · New

_{Review effort: Balanced}

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f12b6e46-8c36-43b5-8de2-9871e18bf50e

Copilot

🟡 Changes recommended

Unresolved guidance can violate OpenAPI response contracts, misconfigure Jackson migration, and prevent security test contexts from loading.

4 open issues

8 resolved since last review

The imported SecurityConfig enables JWT resource-server authentication and requires a…
This catalog entry directs a Boot 4 migration onto the Elasticsearch 8 client line instead of…
The Boot 4 keys bind to JsonReadFeature and JsonWriteFeature, which do not contain these…
In a freshly generated app, Boot still creates its default user, but…
Messaging observations are not enabled automatically by adding the tracing dependencies. For…
A StructuredLoggingJsonMembersCustomizer registered only as a Spring bean is not discovered by…
Replacing null-filtering configuration with .always() reverses its behavior: Boot 4 already skips…
The Boot 3 base class is JsonObjectDeserializer, not JsonValueDeserializer. This migration rule…

_{Review effort: Balanced}

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f12b6e46-8c36-43b5-8de2-9871e18bf50e

Copilot

🟡 Changes recommended

The OpenAPI validation and SPA CSRF guidance can produce incorrect HTTP failures in applications that follow the examples.

2 open issues

The generator options leave useSpringBuiltInValidation=false, which adds type-level @Validated… · New
With its default settings, CsrfTokenRequestAttributeHandler exposes a deferred token but does not… · New

4 resolved since last review

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

Unresolved correctness feedback and broad, version-sensitive security, migration, and native-image guidance require maintainer review.

3 open issues

The generator options leave useSpringBuiltInValidation=false, which adds type-level @Validated…
With servers: [{url: /v1}] and an operation at /pets, this setup exposes /pets rather than… · New
With its default settings, CsrfTokenRequestAttributeHandler exposes a deferred token but does not…

_{Review effort: Balanced}

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f12b6e46-8c36-43b5-8de2-9871e18bf50e

Copilot

🔵 Needs a closer look

The cross-version security, migration, and native-image recipes need final maintainer verification beyond static review.

1 open issue

RestClient and RestClientAdapter require Spring Framework 6.1, and Boot's RestClient.Builder… · New

3 resolved since last review

The generator options leave useSpringBuiltInValidation=false, which adds type-level @Validated…
With servers: [{url: /v1}] and an operation at /pets, this setup exposes /pets rather than…
With its default settings, CsrfTokenRequestAttributeHandler exposes a deferred token but does not…

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

Cross-version security, migration, and native-container guidance needs maintainer validation, and the Boot upgrade routing still needs correction.

2 open issues

java-upgrade handles JDK migrations, not Spring Boot dependency upgrades: its description and… · New
RestClient and RestClientAdapter require Spring Framework 6.1, and Boot's RestClient.Builder…

_{Review effort: Balanced}

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f12b6e46-8c36-43b5-8de2-9871e18bf50e

Copilot

🔵 Needs a closer look

Version-sensitive migration, security, and container guidance needs final maintainer validation beyond static review.

No open issues 🎉

2 resolved since last review

java-upgrade handles JDK migrations, not Spring Boot dependency upgrades: its description and…
RestClient and RestClientAdapter require Spring Framework 6.1, and Boot's RestClient.Builder…

_{Review effort: Balanced}

Add Spring Boot skills (project creation, application development, te…

942a83b

…sting, security, observability, Boot 4 migration) and OpenAPI generation updates Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 041b82be-5972-43b4-b000-870d0d2d9810

Copilot AI balanced review requested due to automatic review settings October 14, 2026 13:59

jdubois requested review from a team as code owners October 14, 2026 13:59

github-actions Bot added agent PR touches agents instructions PR touches instructions new-submission PR adds at least one new contribution skills PR touches skills awaiting-automation merge-risk:medium labels Oct 14, 2026

Copilot started reviewing on behalf of jdubois October 14, 2026 13:59

View session

github-actions Bot added ready-for-review Submission passed intake validation and is ready for maintainer review and removed awaiting-automation labels Oct 14, 2026

Copilot AI reviewed Oct 14, 2026

View reviewed changes

Fix Boot 4 migration guide: Gradle 8.14, retry API, MockMvc note, 4.0…

9408cf5

….x pin Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 041b82be-5972-43b4-b000-870d0d2d9810

Copilot AI balanced review requested due to automatic review settings October 14, 2026 14:13

Copilot started reviewing on behalf of jdubois October 14, 2026 14:14

View session

Clarify Boot 3.5 wrapper prerequisite; fix Boot 4 converter customize…

202ca3b

…r example Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 041b82be-5972-43b4-b000-870d0d2d9810

github-actions Bot added awaiting-automation ready-for-review Submission passed intake validation and is ready for maintainer review and removed ready-for-review Submission passed intake validation and is ready for maintainer review awaiting-automation labels Oct 14, 2026

github-actions Bot added the needs-reviewer label Oct 14, 2026

Copilot AI reviewed Oct 14, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 14, 2026 14:30

Merge latest main and regenerate skills index

f282931

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f12b6e46-8c36-43b5-8de2-9871e18bf50e

github-actions Bot added awaiting-automation review-in-progress and removed approved Submission was approved by a maintainer awaiting-automation labels Oct 22, 2026