56 results available
Sign in
Skills directory

kotlin-springboot

github

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 8 targeted changes and preserved all other text. Classified findings before hardening: 0. Classified findings closed: 0. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 7. Review findings remaining: 1.


Open before hardening

None

Open after hardening

None


Expand
File
Group
Subtype
Severity
Status

No findings available

0 findings


SKILL.md

Spring Boot with Kotlin Best Practices

Your goal is to help me write high-quality, idiomatic Spring Boot applications using Kotlin.

Project Setup & Structure

  • Build Tool: Use Maven (pom.xml) or Gradle (build.gradle) with the Kotlin plugins (kotlin-maven-plugin or org.jetbrains.kotlin.jvm).
  • Kotlin Plugins: For JPA, enable the kotlin-jpa plugin, which generates the no argument constructors that entities need. It does not make classes open. For that, use the Kotlin all open compiler plugin configured for the entity, mapped superclass and embeddable annotations. Also apply the Kotlin Spring compiler plugin, a preset of the all open plugin, so Spring annotated classes and methods are open for proxying.
  • Starters: Use Spring Boot starters (e.g., spring-boot-starter-web, spring-boot-starter-data-jpa) as usual.
  • Version Pinning: Pin the Kotlin and Spring Boot plugin versions explicitly, let the Spring Boot dependency management control starter versions, and resolve dependencies only from trusted repositories such as Maven Central and the Gradle Plugin Portal.
  • Package Structure: Organize code by feature/domain (e.g., com.example.app.order, com.example.app.user) rather than by layer.

Dependency Injection & Components

  • Primary Constructors: Always use the primary constructor for required dependency injection. It's the most idiomatic and concise approach in Kotlin.
  • Immutability: Declare dependencies as private val in the primary constructor. Prefer val over var everywhere to promote immutability.
  • Component Stereotypes: Use @Service, @Repository, and @RestController annotations just as you would in Java.

Configuration

  • Externalized Configuration: Use application.yml for its readability and hierarchical structure.
  • Type-Safe Properties: Use @ConfigurationProperties with data class to create immutable, type-safe configuration objects.
  • Profiles: Use Spring Profiles (application-dev.yml, application-prod.yml) to manage environment-specific configurations.
  • Secrets Management: Never hardcode secrets. Use environment variables or a dedicated secret management tool like HashiCorp Vault or AWS Secrets Manager.

Web Layer (Controllers)

  • RESTful APIs: Design clear and consistent RESTful endpoints.
  • Data Classes for DTOs: Use Kotlin data class for all DTOs. This provides equals(), hashCode(), toString(), and copy() for free and promotes immutability.
  • Validation: Use Java Bean Validation (JSR 380) with annotations (@Valid, @NotNull, @Size) on your DTO data classes. On data class constructor properties, apply constraint annotations with the field use site target so they are actually validated, and place the Valid annotation on the controller request body parameter or on nested properties. Add the Spring Boot validation starter.
  • Error Handling: Implement a global exception handler using @ControllerAdvice and @ExceptionHandler for consistent error responses.

Service Layer

  • Business Logic: Encapsulate business logic within @Service classes.
  • Statelessness: Services should be stateless.
  • Transaction Management: Use @Transactional on service methods. In Kotlin, this can be applied to class or function level. Kotlin classes and functions are final by default, so this relies on the Kotlin Spring compiler plugin to make them open for proxying.

Data Layer (Repositories)

  • JPA Entities: Define entities as regular classes rather than data class types. Remember they must be open and need no argument constructors. Use the all open compiler plugin to make them open and the kotlin-jpa compiler plugin to generate the constructors.
  • Null Safety: Leverage Kotlin's null-safety (?) to clearly define which entity fields are optional or required at the type level.
  • Spring Data JPA: Use Spring Data JPA repositories by extending JpaRepository or CrudRepository.
  • Coroutines: For reactive applications, leverage Spring Boot's support for Kotlin Coroutines in the data layer. Coroutine repositories require a reactive data store. JPA is blocking, so run JPA calls made from suspend functions on an IO dispatcher.

Logging

  • Companion Object Logger: The idiomatic way to declare a logger is in a companion object.
    companion object {
        private val logger = LoggerFactory.getLogger(MyClass::class.java)
    }
  • Parameterized Logging: Use parameterized messages (logger.info("Processing user {}...", userId)) for performance and clarity.

Testing

  • JUnit 5: JUnit 5 is the default and works seamlessly with Kotlin.
  • Idiomatic Testing Libraries: For more fluent and idiomatic tests, consider using Kotest for assertions and MockK for mocking. They are designed for Kotlin and offer a more expressive syntax. Add them from Maven Central using their official artifacts and pin explicit versions.
  • Test Slices: Use test slice annotations like @WebMvcTest or @DataJpaTest to test specific parts of the application.
  • Testcontainers: Use Testcontainers for reliable integration tests with real databases, message brokers, etc.

Coroutines & Asynchronous Programming

  • suspend functions: For non-blocking asynchronous code, use suspend functions in your controllers and services. Spring Boot has excellent support for coroutines.
  • Structured Concurrency: Use coroutineScope or supervisorScope to manage the lifecycle of coroutines.

Install

Install with chainctl
chainctl skill install public/github/kotlin-springboot:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/github/awesome-copilot
Upstream commit1c67e92cd20c7f9e9df117b6ca545707af41faf7
OCI reference

skills.cgr.dev/public/github.com/github/skills/kotlin-springboot:latest

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.