Add lint CI workflow that annotates PRs#139
Conversation
Runs ./gradlew lintDebug on PRs and main pushes, parses Kotlin compiler w:/e: lines, filters to files changed in the diff, and emits GitHub inline annotations. Job fails only when there is at least one error in a changed file; warnings surface but don't block. Entire-Checkpoint: 33aee2ff23e4
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 40 minutes and 1 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughA new GitHub Actions workflow file is introduced that automatically runs Gradle linting on pull requests and main branch pushes, executes lint checks, parses the output, and emits GitHub workflow annotations for errors and warnings found in changed files. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/lint.yml (1)
12-15: Unused permissions.
checks: writeandpull-requests: readaren't used — the workflow only emits::error/::warningworkflow commands (which need no extra permissions) and reads the PR's base/head SHAs from the event payload (not the API). Tightening this keeps least-privilege, especially relevant because this workflow runs onpull_requestfrom forks.Proposed change
permissions: contents: read - pull-requests: read - checks: write🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/lint.yml around lines 12 - 15, The workflow grants unnecessary permissions—remove the unused permissions keys "checks: write" and "pull-requests: read" from the permissions block and keep only the required "contents: read" entry; update the permissions section so it no longer includes checks or pull-requests to enforce least-privilege while retaining reads of the event payload.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/lint.yml:
- Around line 43-45: The workflow step that runs git diff to produce changed.txt
fails silently when github.event.before is the all-zero SHA, producing an empty
changed.txt which causes the Python filter to treat it as "no filter" and
annotate everything; update the step to detect the all-zero or non-fetchable
before SHA (github.event.before), and on that case fall back to diffing against
the previous reachable commit (e.g., HEAD~1 or FETCH_HEAD~1 after fetching the
current commit) or intentionally skip the filter on main; specifically, change
the git diff invocation around the existing git diff --name-only "${{
github.event.before }}" "${{ github.sha }}" > changed.txt || true to first check
for the zero SHA (or a failed fetch) and then use a fallback diff (e.g., git
diff --name-only HEAD~1 "${{ github.sha }}" or fetch the commit and diff
FETCH_HEAD~1) so changed.txt contains the real changed files or you explicitly
mark that filtering should be skipped.
- Around line 49-98: The current regex stored in pattern only matches
diagnostics of the form "^[we]: file://...", so Android Lint console output
(e.g. "path:line: [Type]: message [IssueId]") is ignored; update the workflow to
also capture Android Lint lines by either adding an alternate regex branch to
pattern that matches the Android Lint text format (e.g.
r"^(?P<path>[^:]+):(?P<line>\d+):\s+\[(?P<type>[^\]]+)\]:\s+(?P<msg>.*)$" and
map its groups to sev/msg/col logic) or switch to parsing SARIF/XML by enabling
lint { sarifReport = true } (or XML) in the Android module and reading that
report instead of relying solely on lint.log; adjust the code that computes
sev/errors/warnings and the print annotation so both formats produce GitHub
annotations.
---
Nitpick comments:
In @.github/workflows/lint.yml:
- Around line 12-15: The workflow grants unnecessary permissions—remove the
unused permissions keys "checks: write" and "pull-requests: read" from the
permissions block and keep only the required "contents: read" entry; update the
permissions section so it no longer includes checks or pull-requests to enforce
least-privilege while retaining reads of the event payload.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: dc1213f1-8d7d-47bc-ab00-667240fd1fe7
📒 Files selected for processing (1)
.github/workflows/lint.yml
Review feedback: GitHub Actions supports shell: python directly, so the bash-with-heredoc wrapper is unnecessary. Swapping to the native shell also avoids an extra subprocess and removes the heredoc indentation hazard. Entire-Checkpoint: a2cf709de1e7
On pushes that create a new branch, github.event.before is the all-zero SHA and the previous git diff invocation silently failed through || true, leaving changed.txt empty. The Python filter then treated the empty set as falsy and annotated every lint line in the repo instead of just the pushed diff. Detect the zero/unreachable before SHA and fall back to HEAD^ so changed.txt always reflects the actual push, and switch the Python sentinel from an empty set to None so "no filter available" and "filter exists but matches nothing" stay distinguishable. Entire-Checkpoint: a2cf709de1e7
The Kotlin compiler w:/e: lines in the Gradle console log only cover compilation diagnostics. Android Lint issues (DefaultLocale, PublicKeyCredential, AndroidGradlePluginVersion, etc.) do not appear in the console in a per-issue format, so the previous parser silently dropped them. Read app/build/reports/lint-results-debug.xml in addition to the console log and emit the same GitHub annotations for each issue, mapping severity to error/warning/notice and preserving the issue id inline. Factor the annotation emission into a shared helper so both sources share the changed-files filter and the workspace path normalization. Entire-Checkpoint: c8214104f315
malkoG
force-pushed
the
ci/add-lint-workflow
branch
from
3987eb2 to
258903c
Compare
2 participants
Summary
.github/workflows/lint.yml: on PRs andmainpushes, runs./gradlew lintDebug, parses Kotlin compilerw:/e:lines, filters to files changed in the diff, and emits GitHub inline annotations on the Files Changed view.e:) on a changed file; warnings surface but do not block.lint.logas an artifact for post-hoc inspection.Test plan
Lintcheck runs on this PR.HtmlContent.kt:371(ClickableTextdeprecation) lights up inline when that file is part of the diff, and that files outside the diff produce no annotations.lint-logartifact is available from the run.