Repository navigation
PAY-918: ci: add GitHub Actions workflow for tests and lint - #2
Merged
Merged
Conversation
Runs JVM unit tests (:bank-link, :example) and Android Lint on push to master/develop and on all pull requests. Uses JDK 17 (required by Gradle 8.13 / AGP 8.13.2) with Gradle caching, and uploads test/lint reports as an artifact. Instrumented tests are excluded since they require an emulator. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughA new GitHub Actions CI workflow ( ChangesCI Pipeline Setup
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Warning Review ran into problems🔥 ProblemsThese MCP integrations need to be re-authenticated in the Integrations settings: Linear Comment |
Drops the redundant release-variant unit tests (identical results to debug, double the work) while still covering both modules' debug unit tests. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
1-48:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRestrict
GITHUB_TOKENpermissions explicitly.Line 1 onward defines no
permissions:block, so the workflow falls back to repository defaults. For CI that only checks out, builds, and uploads artifacts, least-privilege should be explicit.Proposed hardening
name: CI +permissions: + contents: read + on: push: branches: [master, develop] pull_request:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 1 - 48, The workflow file is missing an explicit permissions block, causing it to fall back to repository defaults instead of following the principle of least privilege. Add a `permissions:` block at the top level of the workflow (after the `on:` section and before the `concurrency:` section) and grant only the minimum required permissions for the workflow's operations. For this CI workflow that performs checkout, build, and artifact upload, explicitly define the necessary token permissions (such as `contents: read` for code checkout and appropriate permissions for artifact operations) to ensure the GITHUB_TOKEN has minimal required access.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 19-20: The Checkout step using actions/checkout@v4 is using
default behavior which persists credentials in local git config, creating a
security risk. Add `persist-credentials: false` as a parameter under the `uses:
actions/checkout@v4` line in the Checkout step to disable credential persistence
and reduce token exposure risk in downstream workflow steps.
- Around line 20-40: The workflow file uses mutable version tags (like `@v4`) for
third-party GitHub Actions, which creates supply-chain security risks since tags
can be force-pushed to different commits. Replace the mutable tags on the
actions/checkout, actions/setup-java, gradle/actions/setup-gradle, and
actions/upload-artifact actions with their corresponding immutable commit SHAs.
Pin each action to its full commit SHA and include the original version tag as a
comment for readability (for example, @<commit-sha> # v4). Use a dependency
management tool like Dependabot or Renovate to automate future SHA updates.
---
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 1-48: The workflow file is missing an explicit permissions block,
causing it to fall back to repository defaults instead of following the
principle of least privilege. Add a `permissions:` block at the top level of the
workflow (after the `on:` section and before the `concurrency:` section) and
grant only the minimum required permissions for the workflow's operations. For
this CI workflow that performs checkout, build, and artifact upload, explicitly
define the necessary token permissions (such as `contents: read` for code
checkout and appropriate permissions for artifact operations) to ensure the
GITHUB_TOKEN has minimal required access.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 2aa02341-bfd0-45ae-94f0-67eeb71fbceb
📒 Files selected for processing (1)
.github/workflows/ci.yml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 37: The Gradle command in the CI workflow will halt execution when the
first task fails, preventing the subsequent task from running and potentially
missing regressions. Add the `--continue` flag to the Gradle command that runs
both testDebugUnitTest and lint to ensure both checks execute completely
regardless of whether one fails, providing comprehensive CI coverage in a single
run.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: e40a05b4-9106-4847-bc2f-5b21247a2898
📒 Files selected for processing (1)
.github/workflows/ci.yml
Address CodeRabbit review on PR #2: - Set persist-credentials: false on actions/checkout to avoid leaving the token in git config for downstream steps. - Add --continue so lint still runs when unit tests fail (and vice versa), surfacing all failures in a single run. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Run the SDK module's unit tests (both debug and release variants) where the real test suite lives; lint still covers all modules. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Run Android Lint on the SDK module only, matching the test scope. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The slow part of CI is inside the Gradle step (~80s of cold dependency/SDK download before any task runs), not the setup steps. Address it: - setup-gradle: cache-read-only: false so PR runs seed the dependency and build caches instead of always running cold (it is read-only off the default branch by default). - gradle.properties: enable org.gradle.caching (build cache) and org.gradle.parallel so warm runs reuse downloads and compiled output. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
tomschlick
changed the title
PAY-918 Fix Android Lint errors failing CI in bank-link SDK
The new CI workflow (
Action
Context
|
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
14-16: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winAdd timeout to prevent hung builds.
The job lacks a
timeout-minutessetting. If Gradle or tests hang, the job will consume runner resources until the default 6-hour GitHub Actions timeout.Suggested improvement
test-and-lint: name: Unit tests & Android Lint runs-on: ubuntu-latest + timeout-minutes: 30Adjust the timeout value based on typical build duration (currently unknown, but 30 minutes is a reasonable starting point for Android builds with tests).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 14 - 16, The test-and-lint job in the workflow lacks a timeout-minutes setting, which means it could run for up to 6 hours if the build or tests hang. Add a timeout-minutes configuration to the test-and-lint job definition (right after the runs-on line) with a reasonable value such as 30 minutes based on typical Android build and test durations to prevent resource consumption from hung builds.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 34-38: The cache-read-only setting in the setup-gradle action is
currently set to false unconditionally for all workflow events, which allows
pull request branches to write to the shared Gradle cache. To follow Gradle's
security best practices, conditionally set cache-read-only based on the workflow
event type: set it to false only for push events on the default branch (using a
conditional expression that checks if the event is 'push' and the branch is the
default branch), and set it to true for all other events including pull
requests. This will ensure that only trusted push events on the main branch can
populate the cache while PR runs remain read-only.
---
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 14-16: The test-and-lint job in the workflow lacks a
timeout-minutes setting, which means it could run for up to 6 hours if the build
or tests hang. Add a timeout-minutes configuration to the test-and-lint job
definition (right after the runs-on line) with a reasonable value such as 30
minutes based on typical Android build and test durations to prevent resource
consumption from hung builds.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: a5818163-d6cc-46dd-8b85-890ce3210089
📒 Files selected for processing (2)
.github/workflows/ci.ymlgradle.properties
CI runs :bank-link:test + :bank-link:lint, which failed on: - Lint (ContextCastToActivity, 2 errors): BankLinkContent.kt cast LocalContext.current to ComponentActivity. Use androidx.activity.compose LocalActivity.current instead, the API the lint check recommends. - testReleaseUnitTest (2 failures): the two debug-only builder tests assert behavior the release variant intentionally rejects (non-HTTPS appLauncherUrl, testEnvironmentUrl host override), so they threw under BuildConfig.DEBUG == false. Guard them with assumeTrue(BuildConfig.DEBUG) so they stay fully exercised in debug and are skipped in the release variant. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Before going public: with cache-read-only: false, any pull request (including from a fork) could write CI cache entries. Restrict cache writes to trusted push events on master/develop and keep PRs read-only. PRs still restore the warm cache those pushes seed, so the speedup is preserved without exposing a cache-poisoning surface. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
rk111
previously approved these changes
Jun 22, 2026
Set least-privilege permissions at the workflow level. The job only checks out, tests, and lints, so it needs no write scopes on the GITHUB_TOKEN. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
tomschlick
enabled auto-merge (squash)
June 22, 2026 14:56
rk111
approved these changes
Jun 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
.github/workflows/ci.yml— a CI workflow that runs the project's tests and linter on every push tomaster/developand on all pull requests.Details
ubuntu-latest+ JDK 17 (required to run Gradle 8.13 / AGP 8.13.2; bytecode still targets Java 11), with Gradle caching viagradle/actions/setup-gradle../gradlew test— JVM unit tests across both modules (:bank-linkRobolectric/JUnit/Truth/Turbine/Mockito suite +:example)../gradlew lint— Android Lint, the only linter configured in the repo (no detekt/ktlint/spotless present).Not included
connectedAndroidTest(theexample/src/androidTestinstrumented tests) is intentionally left out of this fast PR check since it requires an Android emulator. Can add an emulator job if desired.🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes