maven-gradle-guide — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited maven-gradle-guide (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build tool configuration patterns for Java and Kotlin projects.
A well-organized POM with property management, dependency management, and plugin configuration.
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.2.0</version>
</parent>
<groupId>com.example</groupId>
<artifactId>my-service</artifactId>
<version>1.0.0-SNAPSHOT</version>
<packaging>jar</packaging>
<properties>
<java.version>21</java.version>
<testcontainers.version>1.19.3</testcontainers.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
</project>The equivalent Gradle configuration using the Kotlin DSL for type-safe build scripts.
plugins {
java
id("org.springframework.boot") version "3.2.0"
id("io.spring.dependency-management") version "1.1.4"
}
group = "com.example"
version = "1.0.0-SNAPSHOT"
java {
sourceCompatibility = JavaVersion.VERSION_21
targetCompatibility = JavaVersion.VERSION_21
}
repositories {
mavenCentral()
}
dependencies {
implementation("org.springframework.boot:spring-boot-starter-web")
implementation("org.springframework.boot:spring-boot-starter-data-jpa")
runtimeOnly("org.postgresql:postgresql")
testImplementation("org.springframework.boot:spring-boot-starter-test")
testImplementation("org.testcontainers:postgresql:1.19.3")
}
tasks.test {
useJUnitPlatform()
}Parent POM manages shared configuration; child modules inherit.
<!-- parent pom.xml -->
<project>
<groupId>com.example</groupId>
<artifactId>my-platform</artifactId>
<version>1.0.0-SNAPSHOT</version>
<packaging>pom</packaging>
<modules>
<module>common</module>
<module>api</module>
<module>service</module>
</modules>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>com.example</groupId>
<artifactId>common</artifactId>
<version>${project.version}</version>
</dependency>
</dependencies>
</dependencyManagement>
</project>
<!-- service/pom.xml -- inherits parent, version from dependencyManagement -->
<project>
<parent>
<groupId>com.example</groupId>
<artifactId>my-platform</artifactId>
<version>1.0.0-SNAPSHOT</version>
</parent>
<artifactId>service</artifactId>
<dependencies>
<dependency>
<groupId>com.example</groupId>
<artifactId>common</artifactId>
</dependency>
</dependencies>
</project>// settings.gradle.kts
rootProject.name = "my-platform"
include("common", "api", "service")
// build.gradle.kts (root)
subprojects {
apply(plugin = "java")
group = "com.example"
version = "1.0.0-SNAPSHOT"
repositories { mavenCentral() }
java { sourceCompatibility = JavaVersion.VERSION_21 }
tasks.test { useJUnitPlatform() }
}
// service/build.gradle.kts
dependencies {
implementation(project(":common"))
implementation("org.springframework.boot:spring-boot-starter-web")
}Use BOMs to align versions across a family of libraries. Prevents version conflicts.
<!-- Maven: import BOM in dependencyManagement -->
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.testcontainers</groupId>
<artifactId>testcontainers-bom</artifactId>
<version>1.19.3</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<!-- Now use without version -->
<dependencies>
<dependency>
<groupId>org.testcontainers</groupId>
<artifactId>postgresql</artifactId>
<scope>test</scope>
</dependency>
</dependencies>// Gradle: import BOM via platform()
dependencies {
implementation(platform("org.testcontainers:testcontainers-bom:1.19.3"))
testImplementation("org.testcontainers:postgresql") // no version needed
}<dependencyManagement> or via BOMs. Child modules should omit version tags.build.gradle.kts) provides type safety, auto-completion, and compile-time checks. Prefer it for new projects.maven-shade-plugin when Spring Boot's plugin handles fat JAR packaging correctly. Use the right tool.mvn dependency:tree or gradle dependencies to diagnose.<scope>test</scope> in Maven or testImplementation in Gradle for test-only libraries.Maven lifecycle:
mvn clean compile -- Compile sources
mvn test -- Run tests
mvn package -- Build JAR/WAR
mvn install -- Install to local repo
mvn dependency:tree -- Show dependency tree
Gradle tasks:
gradle build -- Compile + test + package
gradle test -- Run tests
gradle dependencies -- Show dependency tree
gradle bootRun -- Run Spring Boot app
Dependency scopes:
Maven Gradle
compile -> implementation
provided -> compileOnly
runtime -> runtimeOnly
test -> testImplementation~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.