Walkthrough

The archetype now requires appName, derives generated naming and properties from it, changes source and dependency scaffolding, adds Spring and acceptance-test infrastructure, updates documentation, and expands integration verification across project configurations.

Changes

Archetype generation

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant ArchetypeGenerator
  participant GeneratedProject
  participant IntegrationVerifier
  User->>ArchetypeGenerator: provide appName and project options
  ArchetypeGenerator->>GeneratedProject: generate modules, POMs, source trees, and resources
  IntegrationVerifier->>GeneratedProject: inspect metadata, dependencies, and generated files
  GeneratedProject-->>IntegrationVerifier: expose generated project contents

• X
• Mastodon
• Reddit
• LinkedIn

Description

The archetype now generates application.properties that exposes all actuator endpoints and always
shows env values, which can leak secrets and unnecessarily expands attack surface in every generated
Spring app by default.

Code

src/main/resources/META-INF/archetype-post-generate.groovy[R968-978]

+## Actuators
+### enable all endpoints
+management.endpoints.web.exposure.include=*
+
+### show health check details
+management.endpoint.health.show-details=always
+management.endpoint.health.show-components=always
+
+#### display env values (only do this in local or dev environments to avoid display secrets)
+management.endpoint.env.show-values=always
+

Evidence

The generator writes these exact actuator properties into the generated application's
application.properties, meaning every generated Spring app will ship with these permissive
defaults unless the user notices and changes them.

src/main/resources/META-INF/archetype-post-generate.groovy[962-978]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The archetype generates insecure actuator configuration by default (`management.endpoints.web.exposure.include=*` and `management.endpoint.env.show-values=always`). This makes all actuator endpoints remotely accessible (including sensitive ones) and can expose secrets from environment-backed properties.

### Issue Context
These lines are written unconditionally into the generated app module’s `app/src/main/resources/application.properties` whenever `includeSpring` is true.

### Fix Focus Areas
- src/main/resources/META-INF/archetype-post-generate.groovy[962-978]

### Proposed fix
- Change default exposure to a minimal safe set (e.g. `health,info` and optionally `prometheus`).
- Remove `management.endpoint.env.show-values=always` from the default file; if needed for local debugging, put it in `application-local.properties` (or `application-dev.properties`) instead.
- Consider disabling/omitting any especially sensitive endpoints from defaults unless explicitly opted-in.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

The archetype enables datasource-proxy/SQL logging settings and adds the datasource-proxy starter to
acceptance-tests whenever Spring is enabled, even when no database integration exists, creating
unnecessary dependencies and potentially surprising runtime/test auto-configuration behavior.

Code

src/main/resources/META-INF/archetype-post-generate.groovy[R994-1038]

+### Metrics
+jdbc.datasource-proxy.enabled=true
+spring.jpa.properties.hibernate.generate_statistics=true
+
+## Spring Boot Admin
+spring.boot.admin.client.enabled=true
+spring.boot.admin.client.url=TODO SET ME
+
+## JPA
+spring.jpa.show-sql=false
+spring.jpa.hibernate.ddl-auto=none
+
+## Logging
+logging.include-application-name=false
+logging.level.root=INFO
+logging.file.name=TODO SET ME.log
+logging.pattern.file=%date %-10thread %-5level %-100.100logger %mdc: %marker: %msg%n
+logging.logback.rollingpolicy.max-file-size=10gb
+logging.logback.rollingpolicy.max-history=8
+logging.structured.json.context.prefix=labels
+logging.level.org.springframework.transaction.interceptor=TRACE
+
+### SQL logging
+decorator.datasource.enabled=true
+decorator.datasource.datasource-proxy.format-sql=true
+logging.level.net.ttddyy.dsproxy.listener=TRACE
+""")
+
+['ci', 'dev', 'local', 'prod', 'qa', 'uat'].each { profile ->
+    writeFile(projectDir, "app/src/main/resources/application-${profile}.properties", '')
}
}

// ─── acceptance-tests ─────────────────────────────────────────────────────────

+// TEST: common-testing (+ spring-graphql-test when a graphql presentation needs GraphQL test
+// support). PROD: every internal module it depends on ("this app"), + sql logging support.
+def atModuleDeps = [[module: 'common-testing', scope: 'test', label: 'this app']]
+if (includeSpring && hasGraphqlPresentation) {
+    atModuleDeps << [groupId: 'org.springframework.graphql', artifactId: 'spring-graphql-test',
+                     scope: 'test', label: 'spring']
+}
+atModuleDeps += atDeps
+if (includeSpring) atModuleDeps << (DATASOURCE_PROXY_STARTER + [label: 'sql logging'])
+

Evidence

The generator unconditionally writes SQL logging toggles into the app’s application.properties and
unconditionally adds the datasource-proxy starter to acceptance-tests whenever Spring is enabled,
without checking hasDatabaseIntegration.

src/main/resources/META-INF/archetype-post-generate.groovy[962-1020]
src/main/resources/META-INF/archetype-post-generate.groovy[1029-1038]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
SQL logging configuration is generated as always-on (properties) and datasource-proxy is added to `acceptance-tests` for all Spring-enabled projects, regardless of whether a database integration was selected. This is inconsistent with earlier logic that treats SQL logging as database-specific, and it adds extra classpath/auto-config surface to non-DB projects.

### Issue Context
- App config writes `jdbc.datasource-proxy.enabled=true`, `decorator.datasource.enabled=true`, and dsproxy logging levels without checking `hasDatabaseIntegration`.
- `acceptance-tests` adds `datasource-proxy-spring-boot-starter` whenever `includeSpring` is true.

### Fix Focus Areas
- src/main/resources/META-INF/archetype-post-generate.groovy[962-1020]
- src/main/resources/META-INF/archetype-post-generate.groovy[1029-1038]

### Proposed fix
- Only write SQL-logging-related properties when `hasDatabaseIntegration` is true (or move them into a database-specific profile file).
- Only add `DATASOURCE_PROXY_STARTER` to `acceptance-tests` when `hasDatabaseIntegration` is true.
- If SQL logging is intended to be opt-in, consider defaulting the enabling toggles to false and documenting how to enable them.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

The archetype enables Spring Boot Admin client by default but writes
spring.boot.admin.client.url=TODO SET ME, producing a non-functional default configuration that
will trigger failed registration attempts/noisy runtime behavior until manually fixed.

Code

src/main/resources/META-INF/archetype-post-generate.groovy[R998-1001]

+## Spring Boot Admin
+spring.boot.admin.client.enabled=true
+spring.boot.admin.client.url=TODO SET ME
+

Evidence

The generator explicitly writes the Spring Boot Admin client as enabled and assigns a placeholder
URL into the generated config, ensuring the misconfiguration exists in every generated Spring app
unless edited.

src/main/resources/META-INF/archetype-post-generate.groovy[998-1001]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The generated `application.properties` enables the Spring Boot Admin client while providing a placeholder URL value (`TODO SET ME`). This is a configuration footgun: the generated app will attempt (and fail) to register against a meaningless endpoint.

### Issue Context
These properties are written into `app/src/main/resources/application.properties` as part of the archetype post-generate script.

### Fix Focus Areas
- src/main/resources/META-INF/archetype-post-generate.groovy[998-1001]

### Proposed fix
- Default `spring.boot.admin.client.enabled=false` in `application.properties`.
- Provide a commented example URL (or move `enabled=true` + URL into `application-local.properties`) so local/dev users can opt in explicitly.
- Avoid placeholder values that look like real configuration and cause runtime failures.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

The post-generate script calls .trim() on props.getProperty('appName') without null/empty
checks, which can throw a NullPointerException on malformed invocation and can also allow empty
appName values to flow into generated class/config names and POM metadata.

Code

src/main/resources/META-INF/archetype-post-generate.groovy[R176-177]

+def appName = props.getProperty('appName').trim()
+

Evidence

The generator reads appName without a null guard, while metadata marks it required; this
combination means normal flows may be safe, but the script itself is still fragile and will fail
with an unhelpful NPE if invoked with missing properties or empty values slip through.

src/main/resources/META-INF/archetype-post-generate.groovy[173-177]
src/main/resources/META-INF/maven/archetype-metadata.xml[45-49]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`appName` is used as a core naming input, but the generator assumes it is always present and non-empty (`props.getProperty('appName').trim()`). This can NPE if the property is absent and can generate invalid/empty identifiers if the user supplies a blank value.

### Issue Context
`appName` is declared as a required property in archetype metadata, which reduces the likelihood, but the script should still fail fast with a clear error and protect against empty/whitespace values.

### Fix Focus Areas
- src/main/resources/META-INF/archetype-post-generate.groovy[173-181]
- src/main/resources/META-INF/maven/archetype-metadata.xml[45-49]

### Proposed fix
- Read defensively: `(props.getProperty('appName') ?: '').trim()`.
- If blank after trim, throw a clear exception explaining the required format.
- Optionally enforce the documented constraint (capitalized words separated by spaces) before using it to generate Java class names / XML `<name>` values.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools