android-target-ready 0.2.3

Patch release: the action.yml description now fits the GitHub Marketplace limit of 125 characters (it was longer, which blocks publishing). CI checks it. No scanner changes.

v0.2.2

0.2.2 - 2026-10-03

• set-requested-orientation no longer reports an assignment to a local variable named requestedOrientation (int requestedOrientation; requestedOrientation = ...; seen in Telegram-X's CameraController, found by the atl comparison with dependency jars resolved).
• back-keycode also matches != KEYCODE_BACK (if (keyCode != KeyEvent.KEYCODE_BACK || ...) return false handles the back key as much as == does; seen in Anki-Android and SmartTube; on the 54-repository comparison corpus this adds 10 findings, all inside key handlers: 3 in onKey callbacks and 7 in terminal-emulator View handlers).

v0.2.1: three scanner bugs found by cross-checking with android-target-lint

Fixes (details in CHANGELOG): Java banner comments /*////*/ no longer blank the rest of the file; edge-to-edge opt-out with extra attributes is found; requestedOrientation == X is no longer an assignment. Found by comparing with android-target-lint on 52 shared repositories (agreement, not accuracy). Action: uses: cosmichackerx/android-target-ready@v0.2.1.

v0.2.0: PR mode with sticky comment, better targetSdk resolution

What's new

• PR mode (issue #1): --base REF and the Action inputs pr-mode, base, comment, github-token. Only findings the pull request introduces are reported and can fail the build (matched by rule, file and normalised source line, not line number). comment: true keeps one sticky pull request comment up to date (created, updated in place, skipped for forks).
• targetSdk resolver (issue #2): precompiled script plugins matched by plugin id, convention plugin classes matched by alias, multi-line findVersion(..) and dotted catalog accessors, shared root scripts such as common.gradle, lowest value across product flavors; build-plugin directories are no longer mistaken for apps.

Verified

• 41 tests pass; CI green on Ubuntu/Windows/macOS (Python 3.9, 3.11, 3.13), wheel build, Action self-test, the released v0.1.0 consumed from the tag.
• PR mode and the sticky comment ran in CI on the pull request that introduced them (Linux and Windows): exactly one comment existed after two runs.
• Corpus (100 public repos): 6 more modules got a targetSdk, all 6 checked by hand and correct; unresolved fell from 29 to 21 of 143 modules.

Not verified

• No Android runtime test; recall is unmeasured; the sticky comment was tested on same-repo PRs only (fork behaviour is a unit test, not a live run).
• Marketplace listing is a manual step for the repository owner.

v0.1.0: Android targetSdk 36/37 readiness scanner

First release: a static scanner and GitHub Action for the Android 16 (API 36) and Android 17 (API 37) targetSdk behaviour changes plus the Google Play target-API floor.

• 23 rules, each linked to the official Android documentation; text, Markdown, JSON, GitHub annotation and SARIF output.
• targetSdk is read without running Gradle (literals, version catalogs, gradle.properties, ext, Kotlin consts, AGP 9 targetSdk { version = release(..) }, single value in build-logic).
• Composite Action with step summary and SARIF file.

Verified

• 30 tests pass; CI green on Ubuntu, Windows and macOS (Python 3.9, 3.11, 3.13), wheel/sdist build and Action self-test on all three OSes.
• Run over 100 public Android repositories (353 findings in 69 of them). Hand-check of 40 random findings: 7 false positives before fixes, 1 after (docs/precision.md).

Not verified

• No Android runtime test: a finding means "the documented construct is present", not "the app breaks". Recall is not measured.
• The Action was self-tested with uses: ./; use from another repository via the v0.1.0 tag has not been exercised yet.
• Marketplace listing is a manual step for the repository owner (Developer Agreement checkbox in the release form); name uniqueness not checked.