Verification loop for Quarkus projects: build, static analysis, tests with coverage, security scans, native compilation, and diff review before release or PR.

Quarkus Verification Loop Run before PRs, after major changes, and pre deploy. When to Activate Before opening a pull request for a Quarkus service After major refactoring or dependency upgrades Pre deployment verification for staging or production Running full build → lint → test → security scan → native compilation pipeline Validating test coverage meets thresholds (80%+) Testing native image compatibility Phase 1: Build If build fails, stop and fix compilation errors. Phase 2: Static Analysis Checkstyle, PMD, SpotBugs (Maven) SonarQube (if configured) Common Issues to Address Unused imports or variables Complex methods (high cyclomatic complexity) Potential null pointer dereferences Security issues flagged by SpotBugs Phase 3: Tests + Coverage Test Categories Unit Tests Test service logic with mocked dependencies: Integration Tests Test with real database (Testcontainers): API Tests Test REST endpoints with REST Assured: Coverage Report Check target/site/jacoco/index.html for detailed coverage: Overall line coverage (target: 80%+) Branch coverage (target: 70%+) Identify uncovered critical paths Phase 4: Security Scanning Dependency Vulnerabilities (Maven) Review target/dependency check report.html for CVEs. Quarkus Security Audit OWASP ZAP (API Security Testing) Common Security Checks [ ] All secrets in environment variables (not in code) [ ] Input validation on all endpoints [ ] Authentication/authorization configured [ ] CORS properly configured [ ] Security headers set [ ] Passwords hashed with BCrypt [ ] SQL injection protection (parameterized queries) [ ] Rate limiting on public endpoints Phase 5: Native Compilation Test GraalVM native image compatibility: Native Image Troubleshooting Common issues: Reflection : Add reflection config for dynamic classes Resources : Include resources with quarkus.native.resources.includes JNI : Register JNI classes if using native libraries Example reflection config: Phase 6: Performance Testing Load Testing with K6 Run: Metrics to Monitor Response time (p50, p95, p99) Throughput (requests/sec) Error rate Memory usage CPU usage Phase 7: Health Checks Expected responses: Phase 8: Container Image Build Container Security Scan Phase 9: Configuration Validation Environment Specific Checks [ ] Database URLs configured per environment [ ] Secrets externalized (Vault, env vars) [ ] Logging levels appropriate [ ] CORS origins set correctly [ ] Rate limiting configured [ ] Monitoring/tracing enabled Phase 10: Documentation Review [ ] OpenAPI/Swagger docs up to date ( /q/swagger ui ) [ ] README has setup instructions [ ] API changes documented [ ] Migration guide for breaking changes [ ] Configuration properties documented Generate OpenAPI spec: Verification Checklist Code Quality [ ] Build passes without warnings [ ] Static analysis clean (no high/medium issues) [ ] Code follows team conventions [ ] No commented out code or TODOs in PR Testing [ ] All tests pass [ ] Code coverage ≥ 80% [ ] Integration tests with real database [ ] Security tests pass [ ] Performance within acceptable limits Security [ ] No dependency vulnerabilities [ ] Authentication/authorization tested [ ] Input validation complete [ ] Secrets not in source code [ ] Security headers configured Deployment [ ] Native compilation successful [ ] Container image builds [ ] Health checks respond correctly [ ] Configuration valid for target environment Native Image [ ] Native executable builds [ ] Native tests pass [ ] Startup time < 100ms [ ] Memory footprint acceptable Automated Verification Script CI/CD Integration GitHub Actions Example Best Practices Run verification loop before every PR Automate in CI/CD pipeline Fix issues immediately; don't accumulate debt Keep coverage above 80% Update dependencies regularly Test native compilation periodically Monitor performance trends Document breaking changes Review security scan results Validate configuration for each environment

quarkus-verification