Development 2.1.1#321
Conversation
…rtifact-actions chore(deps): update github artifact actions to v7
|
Warning Review limit reached
More reviews will be available in 39 minutes and 23 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (7)
📝 WalkthroughWalkthroughThe PR migrates coverage reporting from Coveralls to Codecov by removing the Coveralls plugin and adding a dedicated coverage job, expands the JDK test matrix from [17, 21] to [17, 21, 25, 26], pins CI action versions, upgrades Gradle wrapper to 9.5.1 with networking configuration, modernizes both POSIX and Windows wrapper scripts to eliminate CLASSPATH handling, updates multiple library and plugin dependencies including Jackson, JUnit BOM, and JaCoCo tooling, and adds a development container with Java 25 and Node.js support. ChangesCoverage Migration and CI Modernization
Development Container Setup
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
fix(deps): update dependency gg.jte:jte to v3.2.4
Coverage Report for CI Build 670Coverage remained the same at 91.327%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
…k-monorepo fix(deps): update junit-framework monorepo to v6.1.0
…ven-publish-java-9.x chore(deps): update plugin io.freefair.maven-publish-java to v9.5.0
…p4j-zip4j-2.x fix(deps): update dependency net.lingala.zip4j:zip4j to v2.11.6
fix(deps): update dependency jacoco to v0.8.15
…-6.x chore(deps): update gradle/actions action to v6
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/gradle.yml (1)
16-18:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRemove the unused global
COVERALLS_REPO_TOKENenv secret.After migrating coverage upload to Codecov, exposing the Coveralls token to all jobs is unnecessary secret surface and violates least-privilege.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/gradle.yml around lines 16 - 18, The COVERALLS_REPO_TOKEN environment variable is still being exposed globally in the workflow file's env section even though coverage reporting has been migrated to Codecov, creating an unnecessary security exposure. Remove the entire COVERALLS_REPO_TOKEN environment variable definition (lines 16-18) from the global env section in the gradle.yml workflow file to follow the principle of least privilege and eliminate unnecessary secret surface area.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/gradle.yml:
- Line 24: The CI workflow matrix in .github/workflows/gradle.yml specifies only
JDK versions 21 and 25, but build.gradle declares Java 17 as the target
bytecode, creating a mismatch between the declared Java compatibility and what
is actually tested. Either add Java 17 to the jdk array in the workflow to
ensure the declared baseline is tested in CI, or update build.gradle to remove
Java 17 as the target bytecode and align it with the CI matrix versions being
tested. Choose whichever matches your actual Java 17 support policy for the
project.
- Line 28: The checkout steps in the workflow file are using the default
credential persistence behavior, which keeps GitHub tokens in local git config
and poses a security risk. Add `persist-credentials: false` to each checkout
step (the uses: actions/checkout action at the line shown and at the additional
locations mentioned in "Also applies to") to explicitly disable credential
persistence unless it is explicitly required for subsequent steps.
- Line 30: Replace the tag-based version pinning for the actions/setup-java and
codecov/codecov-action actions with commit SHA references instead of `@v5` tags.
Tag-based references are mutable and can introduce supply-chain risks, whereas
SHA pinning provides immutability and consistency with the other actions already
used in the workflow. Update each occurrence of these actions to use the full
commit SHA format (e.g., `@<full-commit-sha>`) instead of the version tag.
---
Outside diff comments:
In @.github/workflows/gradle.yml:
- Around line 16-18: The COVERALLS_REPO_TOKEN environment variable is still
being exposed globally in the workflow file's env section even though coverage
reporting has been migrated to Codecov, creating an unnecessary security
exposure. Remove the entire COVERALLS_REPO_TOKEN environment variable definition
(lines 16-18) from the global env section in the gradle.yml workflow file to
follow the principle of least privilege and eliminate unnecessary secret surface
area.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 525c4f61-c482-4801-a7e0-8c0794ca8d2c
📒 Files selected for processing (2)
.github/workflows/gradle.ymlbuild.gradle
chore(deps): update gradle to v9
fix(deps): update slf4j monorepo to v2.0.18
…mons-io-2.x fix(deps): update dependency commons-io:commons-io to v2.22.0
…ev-json-compare-8.x fix(deps): update dependency com.github.fslev:json-compare to v8
fix(deps): update jackson monorepo to v2.22.0
This reverts commit aa9dd72.
…v-action-7.x chore(deps): update codecov/codecov-action action to v7
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
build.gradle (1)
59-59: Movejson-comparetotestImplementationscope.This dependency is used only in test code (UtilFunctionsTest.java and HelpFunctions.java), but is currently added to the runtime classpath via
implementation. UsetestImplementationto exclude it from the published runtime dependencies.Suggested diff
- implementation 'com.github.fslev:json-compare:8.0' + testImplementation 'com.github.fslev:json-compare:8.0'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build.gradle` at line 59, The json-compare dependency is currently declared with the implementation scope in build.gradle at line 59, which includes it in the runtime classpath. Since this dependency is only used in test code, change the scope from implementation to testImplementation to exclude it from published runtime dependencies.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@gradlew.bat`:
- Line 54: The error handling code that executes `"%COMSPEC%" /c exit 1` only
terminates the child command process but allows the parent batch script to
continue executing subsequent statements. After each error exit command in the
script, add an explicit control-flow directive such as `goto :eof` or `exit /b`
immediately following the exit statement to prevent execution fallthrough and
ensure the script terminates properly instead of attempting to run Gradle with
invalid or unset variables like JAVA_EXE.
---
Nitpick comments:
In `@build.gradle`:
- Line 59: The json-compare dependency is currently declared with the
implementation scope in build.gradle at line 59, which includes it in the
runtime classpath. Since this dependency is only used in test code, change the
scope from implementation to testImplementation to exclude it from published
runtime dependencies.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fa9819ec-2750-4709-b55c-090a221b36d5
⛔ Files ignored due to path filters (1)
gradle/wrapper/gradle-wrapper.jaris excluded by!**/*.jar
📒 Files selected for processing (5)
.github/workflows/gradle.ymlbuild.gradlegradle/wrapper/gradle-wrapper.propertiesgradlewgradlew.bat
✅ Files skipped from review due to trivial changes (1)
- gradle/wrapper/gradle-wrapper.properties
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.devcontainer/Dockerfile (2)
4-6: ⚡ Quick winAdd
--no-install-recommendsto reduce image size and attack surface.The
apt-get installcommand lacks--no-install-recommends, which installs unnecessary suggested packages.♻️ Proposed fix
-RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - && \ - apt-get install -y nodejs && \ +RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - && \ + apt-get install -y --no-install-recommends nodejs && \ rm -rf /var/lib/apt/lists/*🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.devcontainer/Dockerfile around lines 4 - 6, The apt-get install command for nodejs lacks the --no-install-recommends flag, which causes unnecessary suggested packages to be installed, increasing image size and attack surface. Add the --no-install-recommends flag to the apt-get install -y nodejs command to prevent installation of recommended but non-essential packages.Source: Linters/SAST tools
7-7: Pin the npm package version for reproducible builds.The
ro-crate-html-jspackage is installed globally without a version constraint. Unpinned installations can lead to non-reproducible builds across environments when the package releases updates.♻️ Proposed fix
-RUN npm install -g ro-crate-html-js +RUN npm install -g ro-crate-html-js@1.4.19 && \ + npm cache clean --force🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.devcontainer/Dockerfile at line 7, In the RUN npm install command for ro-crate-html-js, add a version constraint to pin the package to a specific version. Modify the package specification to include a version number using the format package@version (for example, package@1.2.3) instead of just the package name alone. This ensures that the same version is installed consistently across all builds and environments.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.devcontainer/Dockerfile:
- Around line 4-6: The apt-get install command for nodejs lacks the
--no-install-recommends flag, which causes unnecessary suggested packages to be
installed, increasing image size and attack surface. Add the
--no-install-recommends flag to the apt-get install -y nodejs command to prevent
installation of recommended but non-essential packages.
- Line 7: In the RUN npm install command for ro-crate-html-js, add a version
constraint to pin the package to a specific version. Modify the package
specification to include a version number using the format package@version (for
example, package@1.2.3) instead of just the package name alone. This ensures
that the same version is installed consistently across all builds and
environments.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ec80824e-372b-4447-a6d8-6951c0c40ecb
📒 Files selected for processing (2)
.devcontainer/Dockerfile.devcontainer/devcontainer.json
chore(deps): update gradle to v9.6.0
…ut-7.x chore(deps): update actions/checkout action to v7
…ev-json-compare-8.x fix(deps): update dependency com.github.fslev:json-compare to v8.1
…-artifact-7.x chore(deps): update actions/upload-artifact action to v7.0.1
…java-5.x chore(deps): update actions/setup-java action to v5.3.0
…action-4.x chore(deps): update github/codeql-action action to v4.36.2
…-6.x chore(deps): update gradle/actions action to v6.2.0
2 participants
Summary by CodeRabbit