Pin keep repo commit SHA with CI and Gradle verification#232
Conversation
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 58 minutes and 12 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. WalkthroughThis PR centralizes and enforces a pinned Changes
Sequence Diagram(s)mermaid Workflow->>SetupAction: invoke ./.github/actions/setup-keep Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
build.gradle.kts (1)
87-89: Consider capturing stderr for debugging purposes.Discarding stderr with
redirectError(ProcessBuilder.Redirect.DISCARD)hides potentially useful error information when git fails. Consider capturing it to include in the error message.Optional improvement to capture stderr
val process = ProcessBuilder("git", "-C", keepPath, "rev-parse", "HEAD") - .redirectError(ProcessBuilder.Redirect.DISCARD) + .redirectErrorStream(true) .start() val actualSha = process.inputStream.bufferedReader().use { it.readText() }.trim() if (process.waitFor() != 0) { throw GradleException( - "Failed to read HEAD of $keepPath. " + + "Failed to read HEAD of $keepPath: $actualSha. " + "Fix: git -C $keepPath checkout $pinnedSha" ) }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@build.gradle.kts` around lines 87 - 89, The current ProcessBuilder that runs git rev-parse ("git", "-C", keepPath, "rev-parse", "HEAD") calls redirectError(ProcessBuilder.Redirect.DISCARD) which hides stderr; modify the invocation so stderr is captured (e.g., remove the Redirect.DISCARD and use redirectErrorStream(false) or pipe the error stream) and then read the process's error stream after start() to include any error output in the failure handling/logging for the rev-parse call; ensure you still handle process exit codes and include the captured stderr in the error message so failures are debuggable..github/actions/setup-keep/action.yml (1)
13-16: Add explicit check for missingkeep.versionfile.If
keep.versiondoesn't exist, thetrcommand will succeed with empty output, producing an unclear "invalid keep.version: " error. Adding an explicit file existence check would provide a clearer error message.Suggested improvement
run: | + if [[ ! -f keep.version ]]; then + echo "keep.version file not found" >&2 + exit 1 + fi sha=$(tr -d '[:space:]' < keep.version) [[ "$sha" =~ ^[0-9a-f]{40}$ ]] || { echo "invalid keep.version: $sha" >&2; exit 1; } echo "sha=$sha" >> "$GITHUB_OUTPUT"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/actions/setup-keep/action.yml around lines 13 - 16, Add an explicit existence (and optionally non-empty) check for the keep.version file before running tr: in the run block, verify keep.version exists (e.g., [ -f keep.version ] or [ -s keep.version ]) and fail with a clear error like "missing keep.version" before computing sha; then proceed to set sha=$(tr -d '[:space:]' < keep.version) and validate the SHA as currently done. This ensures the sha variable and invalid message are only shown when the file is present.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/actions/setup-keep/action.yml:
- Around line 13-16: Add an explicit existence (and optionally non-empty) check
for the keep.version file before running tr: in the run block, verify
keep.version exists (e.g., [ -f keep.version ] or [ -s keep.version ]) and fail
with a clear error like "missing keep.version" before computing sha; then
proceed to set sha=$(tr -d '[:space:]' < keep.version) and validate the SHA as
currently done. This ensures the sha variable and invalid message are only shown
when the file is present.
In `@build.gradle.kts`:
- Around line 87-89: The current ProcessBuilder that runs git rev-parse ("git",
"-C", keepPath, "rev-parse", "HEAD") calls
redirectError(ProcessBuilder.Redirect.DISCARD) which hides stderr; modify the
invocation so stderr is captured (e.g., remove the Redirect.DISCARD and use
redirectErrorStream(false) or pipe the error stream) and then read the process's
error stream after start() to include any error output in the failure
handling/logging for the rev-parse call; ensure you still handle process exit
codes and include the captured stderr in the error message so failures are
debuggable.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5923d528-a89f-40e2-8db9-a04bdb9f218b
📒 Files selected for processing (6)
.github/actions/setup-keep/action.yml.github/workflows/ci.yml.github/workflows/release.ymlapp/build.gradle.ktsbuild.gradle.ktskeep.version
2 participants
Summary by CodeRabbit