A framework-aware static analysis plugin for Maven and Gradle. It blocks your CI/CD pipeline when it detects dangerous code, hardcoded secrets, or bad architectural practices.
Spring Sentinel 2.0.0 supports both Maven and Gradle. Choose your build tool and run the audit in your CI/CD pipeline.
<plugin>
<groupId>io.github.pagano-antonio</groupId>
<artifactId>spring-sentinel-maven-plugin</artifactId>
<version>2.0.0</version>
<executions>
<execution>
<phase>verify</phase>
<goals>
<goal>audit</goal>
</goals>
</execution>
</executions>
<configuration>
<profile>strict</profile>
<failOnError>false</failOnError>
</configuration>
</plugin>Run the audit:
Reports:
plugins {
id "io.github.pagano-antonio.spring-sentinel" version "2.0.0"
}
springSentinel {
profile = "strict"
failOnError = false
}Run the audit:
Reports:
Spring Sentinel 2.0.0 introduces a new multi-module structure. Existing 1.x users can keep using the old artifact, but when upgrading to 2.0.0 the Maven plugin artifact has changed.
Old 1.x artifact:
New 2.0 artifact:
Standard linters check syntax. We check your Spring architecture. Here is a taste of what Sentinel catches before your build fails.
Scans JPA entities for FetchType.EAGER to prevent unnecessary loading of complex object graphs, which causes memory overhead and performance degradation.
Identifies collection getters called within loops, a common cause of database performance issues.
Detects blocking I/O or network calls within @Transactional methods to prevent connection pool exhaustion.
Checks class fields and properties for sensitive variable names that do not use environment variable placeholders.
Reports the use of the wildcard in @CrossOrigin annotations, which poses a significant security risk to production APIs.
Reports the use of @Autowired on private fields, encouraging constructor injection for better testability and immutability.
Monitors the number of dependencies in a class and suggests refactoring into smaller services if the limit is exceeded.
Detects manual thread creation and suggests the use of managed @Async tasks.
Ensures that endpoint URLs follow the kebab-case convention rather than camelCase or snake_case.