quarkus-verification

Topics in the source

• Quarkus Verification Loop
• When to Activate
• Phase 1: Build
• Phase 2: Static Analysis
• Checkstyle, PMD, SpotBugs (Maven)
• SonarQube (if configured)
• Common Issues to Address
• Phase 3: Tests + Coverage

Run before PRs, after major changes, and pre-deploy. Before opening a pull request for a Quarkus service After major refactoring or dependency upgrades Pre-deployment verification for staging or production Running full build → lint → test → security scan → native compilation pipeline Validating test coverage meets thresholds (80%+) Testing native image compatibility If build fails, stop and fix compilation errors. Unused imports or variables Complex methods (high cyclomatic complexity) Potential null pointer dereferences Security issues flagged by SpotBugs Test service logic with mocked dependencies: Test with real database (Testcontainers): Test REST endpoints with REST Assured: Check target/site/jacoco/index.html for detailed coverage: Overall line coverage (target: 80%+) Branch coverage (target: 70%+) Identify uncovered critical paths Review target/dependency-check-report.html for CVEs. [ ] All secrets in environment variables (not in code) [ ] Input validation on all endpoints [ ] Authentication/authorization configured [ ] CORS properly configured [ ] Security headers set [ ] Passwords hashed with BCrypt [ ] SQL injection protection (parameterized queries) [ ] Rate limiting on

This is an excerpt. Refer to the complete source and its current requirements.