Java Development

GitHubOfficialFirst committed by jduboisDistributed by GitHub

Skill
Tool integration
Software development
MIT
No issues found

From the author

Day-to-day plain Java development without a framework: Maven and Gradle usage and wrappers, project layout, dependency and vulnerability management, modern Java idioms by JDK version (records, sealed types, pattern matching, virtual threads), SLF4J logging, error and null handling, immutability, concurrency basics, static analysis and formatting (Spotless, Error Prone, -Xlint), packaging (jar, jlink, jpackage) and GitHub Actions CI. Use when writing, building, reviewing or maintaining ordinary Java code.

— the description by jdubois

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides comprehensive support for standard Java development, focusing on build tool management (Maven/Gradle), dependency hygiene, and the application of modern Java idioms based on the project's specific JDK version. It emphasizes best practices for code quality, static analysis, and packaging, ensuring that development remains consistent with the project's existing configuration and standards.

What it does

Manages Maven and Gradle build configurations, wrappers, and multi-module layouts.
Provides version-specific Java idiom guidance from JDK 8 through 25.
Handles dependency management, vulnerability scanning, and conflict resolution.
Configures static analysis tools like Spotless, Error Prone, and -Xlint.
Supports packaging applications into jars, jlink images, or jpackage installers.
Maintains CI pipelines using GitHub Actions.

When to use it

When writing, building, or refactoring plain Java code without a framework.
When upgrading or aligning code to match a project's specific Java release.
When diagnosing build failures, dependency conflicts, or vulnerability alerts.
When setting up or maintaining project-wide formatting and static analysis rules.
When preparing a Java application for deployment or distribution.

Advantages

Ensures strict adherence to project-specific Java versions and build configurations.
Promotes clean, idiomatic code using the latest features supported by the project.
Reduces technical debt through proactive dependency and vulnerability management.
Standardizes build processes and CI/CD workflows.
Prevents common pitfalls related to JDK-specific changes and preview features.

Usage examples

“How do I implement a record-based switch expression in this project?”: The agent checks the project's Java release; if it is 21 or higher, it provides a code snippet using record patterns and exhaustive switch expressions.
“Check for dependency updates and resolve a conflict in my Maven build.”: The agent runs dependency analysis commands, identifies the conflicting versions, and suggests a fix using dependencyManagement in the pom.xml.
“Add a GitHub Actions workflow to run my Gradle build.”: The agent generates a standard CI file using actions/setup-java and the project's wrapper, ensuring the build is verified on every push.
“How can I use virtual threads for my I/O tasks?”: The agent verifies the project is on JDK 21+, explains the use of Executors.newVirtualThreadPerTaskExecutor, and warns about blocking synchronization.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/github/java-development/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip java-development.zip -d .agents/skills

Documentation by jdubois

Java Development (plain Java)

Everyday guidance for Java projects that are not tied to a framework. If the project uses Spring Boot, Quarkus, Helidon or similar, prefer that framework's skills for framework concerns and use this one for the plain-Java parts.

Rules that always apply

Detect before you write. Read pom.xml/build.gradle*, .mvn/, gradle/, .java-version/.sdkmanrc, .editorconfig, CI files, and a few source files. Match the build tool, Java release, formatter, naming, logging and test libraries already in use.
Never upgrade implicitly. Do not change the Java release, build-tool version, plugin or dependency versions, or add a formatter/linter/static analyzer the project lacks, as a side effect of another task. Suggest it and ask. Version upgrades are their own task (java-upgrade, if installed).
Use the wrapper (./mvnw, ./gradlew) when present; otherwise the installed mvn/gradle. Do not commit a wrapper unprompted.
Verify with a build. After any change run the project's own verification (./mvnw -B verify or ./gradlew build) and report the result. Run a narrower command first while iterating. If you could not run it, say so.
Ask the user before: changing public APIs or serialized/DB/wire formats, raising the Java release, adding runtime dependencies, adding tools to the build, deleting or weakening tests, changing CI, or when two reasonable designs have different trade-offs.
Prefer the standard library and small, explicit code over new dependencies. No Lombok unless already used.

Pick idioms by the project's Java release

Check maven.compiler.release/<release>, java.toolchain, or sourceCompatibility; never use a feature newer than that release. Summary (details and snippets in references/modern-java.md):

Release	You can use
8	lambdas, streams, `Optional`, `java.time`
11	`var`, `String.isBlank/strip/lines`, `java.net.http.HttpClient`, `List.of`/`Map.of` (9)
17	records, sealed classes, text blocks, switch expressions, `instanceof` patterns
21	pattern matching for `switch`, record patterns, virtual threads, `SequencedCollection` (`getFirst/getLast/reversed`)
22-24	unnamed variables `_` (22), `Stream.gather` (24)
25	scoped values, instance `main`/compact source files, module import declarations (all final)

Structured concurrency (StructuredTaskScope) is still a preview API in 25 and 27 (verified: needs --enable-preview); do not use it in production code unless the user opts in to preview features.

Build tools in practice

Maven: ./mvnw -B verify (compile, unit tests, integration tests, packaging), -pl <module> -am for one module, dependency:tree, -DskipTests only when the user asks. Gradle: ./gradlew build, test --tests 'pkg.Class', dependencies, dependencyInsight --dependency <name>.
Standard layout: src/main/java, src/main/resources, src/test/java, src/test/resources; package by feature, one top-level type per file, no split packages.
Set the Java version explicitly (maven.compiler.release / Gradle toolchain with options.release) and UTF-8 encoding; do not rely on the JDK that happens to run the build.
Wrapper, BOM and dependency:tree/versions: usage, version catalogs and multi-module layout: references/build-and-dependencies.md.

Dependencies and vulnerabilities

Import BOMs (junit-bom, testcontainers-bom, the framework's BOM) instead of repeating versions; one version per library across modules.
Inspect before changing: mvn dependency:tree -Dincludes=group:artifact / gradlew dependencyInsight. Resolve conflicts with dependencyManagement or Gradle constraints, not by excluding randomly.
Check updates with mvn versions:display-dependency-updates (add -Dmaven.version.ignore to hide alpha/beta/RC) and report them; do not apply major upgrades without asking.
Vulnerabilities: use what the project has (Dependabot/Renovate alerts, OWASP dependency-check, OSV-Scanner, GitHub dependency review). Suggest one if none exists; do not add it silently. Keep secrets out of scanner config; NVD-based scanners need an API key to be practical.

Version-dependent failures (verified)

JDK 23+ no longer runs annotation processors implicitly (Lombok, MapStruct, Dagger...): -proc:none is the default unless -processor, --processor-path or --processor-module-path is given. Declare the processor path in the build (Maven annotationProcessorPaths, Gradle annotationProcessor) or pass -proc:full. JDK 21+ prints a warning when it detects implicit use; -proc:full is also backported to 17.0.11, 11.0.23 and 8u411. Source: https://inside.java/2024/06/18/quality-heads-up/.
Virtual threads and synchronized: on JDK 21-23 a virtual thread that blocks inside synchronized is pinned to its carrier; JEP 491 removes nearly all such pinning in JDK 24+. On 21-23 prefer ReentrantLock around blocking calls. Source: https://openjdk.org/jeps/491.
Error Prone on JDK 16+ needs the --add-exports/--add-opens javac flags, and on JDK 21 -XDaddTypeAnnotationsToSymbol=true (see the quality reference).
Never use a language feature newer than the project's release (see the table above).

Static analysis and formatting (only if already present, or the user agrees)

Respect what is configured: if the project uses Spotless/Checkstyle/SpotBugs/Error Prone, run them and fix findings; if not, do not add them. When asked to introduce them, start with -Xlint:all and Spotless (formatter only), then Error Prone. Verified configs for Maven and Gradle on JDK 21 and 25 (including the JDK-21-only -XDaddTypeAnnotationsToSymbol=true requirement and Maven .mvn/jvm.config flags) are in references/quality-and-packaging.md. Never reformat the whole codebase in an unrelated change.

Packaging and CI

Plain library jar: mvn package/gradlew jar. Runnable app: shaded/fat jar or lib/ directory plus manifest Main-Class; custom runtime with jlink; native installer/app-image with jpackage (verified on macOS, see references/quality-and-packaging.md).
GitHub Actions: actions/checkout, actions/setup-java with distribution: temurin, an explicit java-version, built-in dependency cache, then ./mvnw -B verify or ./gradlew build. Snippet and notes in references/quality-and-packaging.md. Do not change CI without asking.

java-junit (unit tests), java-testcontainers (integration tests with Docker), java-hibernate-jpa (persistence), java-debugging (failures and stack traces), java-diagnostics (performance, memory, threads, JFR), java-upgrade (JDK/framework upgrades), lsp-setup (Java language server for navigation and refactoring).

References

references/modern-java.md: idioms and verified snippets (records, sealed types, switch patterns, text blocks, virtual threads, SequencedCollection, unnamed variables), preview status, pitfalls.
references/build-and-dependencies.md: Maven/Gradle commands, wrappers, BOMs, conflict diagnosis, update checking, Dependabot/Renovate, vulnerability scanning.
references/quality-and-packaging.md: logging setup, -Xlint, Spotless, Error Prone, Checkstyle/SpotBugs notes, jar/jlink/jpackage, GitHub Actions.

Files

ATTRIBUTION.mdAdded by AutoGineer863 B
LICENSELicence file added by AutoGineer1.0 KiB
SKILL.md7.7 KiB
references/build-and-dependencies.md5.3 KiB
references/modern-java.md5.3 KiB
references/quality-and-packaging.md8.7 KiB

references/build-and-dependencies.md

Build tools, dependencies and vulnerabilities

Commands below were run on Maven 3.10.0 / 3.9.11 (wrapper) and Gradle 9.8.1 with JDK 21 and 25 unless marked unverified.

Maven

mvn -v                               # shows Maven AND the JDK it runs on; check it matches the project's release
./mvnw -B verify                     # compile + unit tests + integration tests (+ checks bound to verify)
./mvnw -B -q test                    # unit tests only
./mvnw -B -pl service -am verify     # one module and what it depends on
./mvnw -B dependency:tree -Dincludes=org.slf4j
./mvnw -B versions:display-dependency-updates
./mvnw -B versions:display-plugin-updates

Generate a wrapper (only when the user wants one): mvn wrapper:wrapper -Dmaven=3.9.11 creates mvnw, mvnw.cmd, .mvn/wrapper/maven-wrapper.properties (verified, wrapper 3.3.4, script-only distribution that downloads Maven on first run). Commit those files and keep .mvn/ in version control.

Minimal pom.xml essentials:

<properties>
  <maven.compiler.release>21</maven.compiler.release>
  <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>

Pin plugin versions (maven-compiler-plugin 3.16.0, maven-surefire-plugin 3.6.0, maven-jar-plugin 3.5.1 were used in verification) instead of relying on Maven's defaults; an explicit <release> beats source/target.

versions:display-dependency-updates also proposes pre-releases (it proposed slf4j-api 2.1.0-alpha1). Hide them with -Dmaven.version.ignore='(?i).*(alpha|beta|rc|-m)[-.0-9]*' (verified: the alpha disappears). Report updates; do not apply majors without asking.

Multi-module: a parent pom.xml with <packaging>pom</packaging>, <modules>, and <dependencyManagement>/<pluginManagement>; children inherit versions. Do not use -Dmaven.test.failure.ignore to get a green build.

Gradle

./gradlew build                      # compile + test + check
./gradlew test --tests 'demo.OrdersTest'
./gradlew dependencies --configuration runtimeClasspath
./gradlew dependencyInsight --dependency slf4j-api --configuration runtimeClasspath
./gradlew --version                  # Gradle + JVM

Generate a wrapper: gradle wrapper --gradle-version 9.8.1 (verified; creates gradlew, gradlew.bat, gradle/wrapper/*). Upgrade later with ./gradlew wrapper --gradle-version <v> only when asked.

plugins { java }
repositories { mavenCentral() }
java { toolchain { languageVersion = JavaLanguageVersion.of(21) } }
tasks.withType<JavaCompile>().configureEach { options.release = 21 }
dependencies {
    implementation("org.slf4j:slf4j-api:2.0.20")
    runtimeOnly("ch.qos.logback:logback-classic:1.6.5")
    testImplementation(platform("org.junit:junit-bom:6.0.3"))
    testImplementation("org.junit.jupiter:junit-jupiter")
    testRuntimeOnly("org.junit.platform:junit-platform-launcher")
}
tasks.test { useJUnitPlatform() }

A toolchain makes Gradle pick or download the right JDK; keep the toolchain version equal to the release. Prefer a version catalog (gradle/libs.versions.toml) when the project already has one. Use api vs implementation only in java-library projects.

Dependency hygiene

BOMs: Maven <scope>import</scope> in dependencyManagement; Gradle platform("group:bom:version").
When a transitive version is wrong, find who brings it (dependency:tree / dependencyInsight), then override with dependencyManagement or a Gradle constraints {} block with a comment saying why.
Do not mix two logging backends or two JSON/mapping libraries without reason; check the tree for duplicates (e.g. both logback-classic and slf4j-simple).
Remove unused dependencies (mvn dependency:analyze reports used-undeclared and unused-declared; review by hand before deleting, since reflection and runtime-only libraries are false positives).
Scope correctly: test libs test, JDBC drivers/logging backends runtime.

Automated updates

Dependabot (.github/dependabot.yml), unverified here but standard:

version: 2
updates:
  - package-ecosystem: maven        # or gradle
    directory: "/"
    schedule: { interval: weekly }
    groups:
      minor-and-patch:
        update-types: [minor, patch]
  - package-ecosystem: github-actions
    directory: "/"
    schedule: { interval: weekly }

Renovate (renovate.json) is the alternative; both need the user's consent to enable. Merge update PRs only when verify passes.

Vulnerability scanning (unverified here)

Not run in this skill's verification (it needs network downloads of vulnerability databases and, for NVD, an API key). Pick what fits the project:

GitHub Dependabot alerts / dependency review action (no build change).
OWASP dependency-check Maven plugin org.owasp:dependency-check-maven (13.0.0 on Maven Central when this was written): mvn org.owasp:dependency-check-maven:check -DnvdApiKeyEnvironmentVariable=NVD_API_KEY; set NVD_API_KEY via CI secret, never in the repo or as a literal command-line value. The parameter tells the plugin which environment variable to read; exporting the variable alone does not configure it.
OSV-Scanner (osv-scanner scan source -r .) reads pom.xml/Gradle lockfiles.

Report findings with the vulnerable artifact, the fixed version and whether it is direct or transitive; fix by raising the managed version, and run verify.

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by

jdubois

Publisher

GitHub (Official)

Distributed by

GitHub

Source

github/awesome-copilot · skills/java-development · commit 797337f

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

Contributors