Java-Helidon
Java-Helidon is an code AI skill with a core value of Get best practices for developing applications with Helidon 4 (SE and MP). It
helps developers solve real-world problems in the code domain, boosting
efficiency, automating repetitive tasks, and optimizing workflows.
Get best practices for developing applications with Helidon 4 (SE and MP). Use when working with Helidon SE or Helidon MP, HttpService routing, Helidon DB Client, MicroProfile Config, Helidon Security
Quick Facts
mkdir -p ./skills/java-helidon && curl -sfL https://raw.githubusercontent.com/github/awesome-copilot/main/skills/java-helidon/SKILL.md -o ./skills/java-helidon/SKILL.md Run in terminal / PowerShell. Requires curl (Unix) or PowerShell 5+ (Windows).
Skill Content
# Helidon Best Practices
Your goal is to help me write high-quality Helidon applications by following established best practices.
Helidon 3 → 4 API changes
Helidon 4 renamed or resignatured APIs that appear widely in their Helidon 3 form.
The left column does not compile on Helidon 4. Check generated code against this table
before returning it.
| Do not use (Helidon 3) | Use (Helidon 4) |
| ---------------------------------------------------------- | ------------------------------------------------------------------ |
| `io.helidon.common.http.Http.Status` | `io.helidon.http.Status` |
| `io.helidon.webserver.Service` | `io.helidon.webserver.http.HttpService` |
| `Routing.Rules`, `update(Routing.Rules)` | `HttpRules`, `routing(HttpRules)` |
| `request.path().param("id")` | `request.path().pathParameters().get("id")` |
| `String s = column.as(String.class)` | `column.getString()` or `column.get(String.class)` |
| `dbClient.execute(exec -> ...)` returning `Single`/`Multi` | `dbClient.execute()` returning `Optional<DbRow>` / `Stream<DbRow>` |
| `javax.*` | `jakarta.*` |
| `helidon-microprofile-tests-junit5` | `helidon-microprofile-testing-junit5` |
`Value.as(Class)` in Helidon 4 returns `OptionalValue<T>`, not `T`. This is the single
most common Helidon 4 compile error in generated code.
Project Setup & Structure
- **Programming Model:** Determine whether the project uses Helidon SE or Helidon MP before generating code. Do not mix the two programming models unless explicitly required.
- **Java Version:** Use Java 21 or later for Helidon 4 applications.
- **Build Tool:** Use Maven (`pom.xml`) or Gradle (`build.gradle`) for dependency management.
- **Dependency Management:** Use the Helidon BOM or platform to keep Helidon module versions aligned.
- **Package Structure:** Organize code by feature or domain, such as `com.example.app.order` and `com.example.app.customer`, rather than only by technical layer.
Helidon SE
- **Explicit Composition:** Construct services and dependencies explicitly in the application bootstrap layer.
- **Constructor Injection:** Pass required dependencies through constructors and declare dependency fields as `private final`.
- **HTTP Services:** Group related routes in focused `HttpService` implementations.
- **Business Logic:** Keep business logic outside route handlers.
- **Virtual Threads:** Prefer straightforward blocking code with Helidon 4 virtual-thread-based request handling. Do not introduce reactive complexity without a clear reason. Helidon 4 is not reactive; do not generate `Single`, `Multi`, or `CompletionStage` chains.
Helidon MP
- **Jakarta and MicroProfile:** Prefer standard Jakarta EE and Eclipse MicroProfile APIs when available.
- **Dependency Injection:** Use CDI with constructor injection for required dependencies.
- **Bean Scopes:** Use CDI scopes such as `@ApplicationScoped` and `@RequestScoped` intentionally.
- **Normal-Scoped Beans:** Add a non-private no-argument constructor to normal-scoped beans that use constructor injection, so the CDI client proxy can be created portably.
- **Business Logic:** Keep Jakarta REST resource classes thin and delegate business operations to service classes.
- **Portability:** Prefer portable Jakarta and MicroProfile APIs over Helidon-specific APIs when portability is important.
Configuration
- **Externalized Configuration:** Store non-secret configuration in `application.yaml` or `application.properties`.
- **Helidon SE Configura
🎯 Best For
- Security auditors
- DevSecOps teams
- Compliance officers
- Claude users
- GitHub Copilot users
💡 Use Cases
- Auditing dependencies for known CVEs
- Scanning API endpoints for auth gaps
- Code quality improvement
- Best practice enforcement
📖 How to Use This Skill
- 1
Install the Skill
Copy the install command from the Terminal tab and run it. The SKILL.md file downloads to your local skills directory.
- 2
Load into Your AI Assistant
Open Claude or GitHub Copilot and reference the skill. Paste the SKILL.md content or use the system prompt tab.
- 3
Apply Java-Helidon to Your Work
Open your project in the AI assistant and ask it to apply the skill. Start with a small module to verify the output quality.
- 4
Review and Refine
Review AI suggestions before committing. Run tests, check for regressions, and iterate on the skill output.
❓ Frequently Asked Questions
Can this replace a dedicated SAST tool?
AI-based security review is complementary to SAST tools. Use it as a first-pass filter, not a replacement.
Is Java-Helidon compatible with Cursor and VS Code?
Yes — this skill works with any AI coding assistant including Cursor, VS Code with Copilot, and JetBrains IDEs.
Do I need specific dependencies for Java-Helidon?
Check the install command and Works With section. Most code skills only require the AI assistant and your codebase.
How do I install Java-Helidon?
Copy the install command from the Terminal tab and run it. The skill downloads to ./skills/java-helidon/SKILL.md, ready to use.
Can I customize this skill for my team?
Absolutely. Edit the SKILL.md file to add team-specific instructions, examples, or workflows.
⚠️ Common Mistakes to Avoid
Only scanning surface-level issues
Deep security review requires understanding your app architecture, not just regex patterns.
Skipping validation
Always test AI-generated code changes, even for simple refactors.
Missing dependency updates
Check if the skill requires updated dependencies or new packages.