Development 2.1.1#321
Open
Pfeil wants to merge 33 commits into
Open
Conversation
…rtifact-actions chore(deps): update github artifact actions to v7
Contributor
📝 WalkthroughWalkthroughThe PR migrates coverage reporting from Coveralls to Codecov by removing the Coveralls plugin and adding a dedicated coverage job, expands the JDK test matrix from [17, 21] to [17, 21, 25, 26], pins CI action versions, upgrades Gradle wrapper to 9.5.1 with networking configuration, modernizes both POSIX and Windows wrapper scripts to eliminate CLASSPATH handling, and updates multiple library and plugin dependencies including Jackson, JUnit BOM, and JaCoCo tooling. ChangesCoverage Migration and CI Modernization
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
fix(deps): update dependency gg.jte:jte to v3.2.4
Coverage Report for CI Build 670Coverage remained the same at 91.327%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
…k-monorepo fix(deps): update junit-framework monorepo to v6.1.0
…ven-publish-java-9.x chore(deps): update plugin io.freefair.maven-publish-java to v9.5.0
…p4j-zip4j-2.x fix(deps): update dependency net.lingala.zip4j:zip4j to v2.11.6
fix(deps): update dependency jacoco to v0.8.15
…-6.x chore(deps): update gradle/actions action to v6
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/gradle.yml (1)
16-18:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRemove the unused global
COVERALLS_REPO_TOKENenv secret.After migrating coverage upload to Codecov, exposing the Coveralls token to all jobs is unnecessary secret surface and violates least-privilege.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/gradle.yml around lines 16 - 18, The COVERALLS_REPO_TOKEN environment variable is still being exposed globally in the workflow file's env section even though coverage reporting has been migrated to Codecov, creating an unnecessary security exposure. Remove the entire COVERALLS_REPO_TOKEN environment variable definition (lines 16-18) from the global env section in the gradle.yml workflow file to follow the principle of least privilege and eliminate unnecessary secret surface area.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/gradle.yml:
- Line 24: The CI workflow matrix in .github/workflows/gradle.yml specifies only
JDK versions 21 and 25, but build.gradle declares Java 17 as the target
bytecode, creating a mismatch between the declared Java compatibility and what
is actually tested. Either add Java 17 to the jdk array in the workflow to
ensure the declared baseline is tested in CI, or update build.gradle to remove
Java 17 as the target bytecode and align it with the CI matrix versions being
tested. Choose whichever matches your actual Java 17 support policy for the
project.
- Line 28: The checkout steps in the workflow file are using the default
credential persistence behavior, which keeps GitHub tokens in local git config
and poses a security risk. Add `persist-credentials: false` to each checkout
step (the uses: actions/checkout action at the line shown and at the additional
locations mentioned in "Also applies to") to explicitly disable credential
persistence unless it is explicitly required for subsequent steps.
- Line 30: Replace the tag-based version pinning for the actions/setup-java and
codecov/codecov-action actions with commit SHA references instead of `@v5` tags.
Tag-based references are mutable and can introduce supply-chain risks, whereas
SHA pinning provides immutability and consistency with the other actions already
used in the workflow. Update each occurrence of these actions to use the full
commit SHA format (e.g., `@<full-commit-sha>`) instead of the version tag.
---
Outside diff comments:
In @.github/workflows/gradle.yml:
- Around line 16-18: The COVERALLS_REPO_TOKEN environment variable is still
being exposed globally in the workflow file's env section even though coverage
reporting has been migrated to Codecov, creating an unnecessary security
exposure. Remove the entire COVERALLS_REPO_TOKEN environment variable definition
(lines 16-18) from the global env section in the gradle.yml workflow file to
follow the principle of least privilege and eliminate unnecessary secret surface
area.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 525c4f61-c482-4801-a7e0-8c0794ca8d2c
📒 Files selected for processing (2)
.github/workflows/gradle.ymlbuild.gradle
chore(deps): update gradle to v9
fix(deps): update slf4j monorepo to v2.0.18
…mons-io-2.x fix(deps): update dependency commons-io:commons-io to v2.22.0
…ev-json-compare-8.x fix(deps): update dependency com.github.fslev:json-compare to v8
fix(deps): update jackson monorepo to v2.22.0
This reverts commit aa9dd72.
…v-action-7.x chore(deps): update codecov/codecov-action action to v7
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
build.gradle (1)
59-59: Movejson-comparetotestImplementationscope.This dependency is used only in test code (UtilFunctionsTest.java and HelpFunctions.java), but is currently added to the runtime classpath via
implementation. UsetestImplementationto exclude it from the published runtime dependencies.Suggested diff
- implementation 'com.github.fslev:json-compare:8.0' + testImplementation 'com.github.fslev:json-compare:8.0'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build.gradle` at line 59, The json-compare dependency is currently declared with the implementation scope in build.gradle at line 59, which includes it in the runtime classpath. Since this dependency is only used in test code, change the scope from implementation to testImplementation to exclude it from published runtime dependencies.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@gradlew.bat`:
- Line 54: The error handling code that executes `"%COMSPEC%" /c exit 1` only
terminates the child command process but allows the parent batch script to
continue executing subsequent statements. After each error exit command in the
script, add an explicit control-flow directive such as `goto :eof` or `exit /b`
immediately following the exit statement to prevent execution fallthrough and
ensure the script terminates properly instead of attempting to run Gradle with
invalid or unset variables like JAVA_EXE.
---
Nitpick comments:
In `@build.gradle`:
- Line 59: The json-compare dependency is currently declared with the
implementation scope in build.gradle at line 59, which includes it in the
runtime classpath. Since this dependency is only used in test code, change the
scope from implementation to testImplementation to exclude it from published
runtime dependencies.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fa9819ec-2750-4709-b55c-090a221b36d5
⛔ Files ignored due to path filters (1)
gradle/wrapper/gradle-wrapper.jaris excluded by!**/*.jar
📒 Files selected for processing (5)
.github/workflows/gradle.ymlbuild.gradlegradle/wrapper/gradle-wrapper.propertiesgradlewgradlew.bat
✅ Files skipped from review due to trivial changes (1)
- gradle/wrapper/gradle-wrapper.properties
| echo location of your Java installation. 1>&2 | ||
|
|
||
| goto fail | ||
| "%COMSPEC%" /c exit 1 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Show the Java-discovery exit commands and the immediately following control-flow lines.
python - <<'PY'
from pathlib import Path
lines = Path("gradlew.bat").read_text().splitlines()
for i, line in enumerate(lines, start=1):
if line.strip() == '"%COMSPEC%" /c exit 1':
print(f"Line {i}: {line}")
for j in range(i + 1, min(i + 4, len(lines) + 1)):
print(f"Line {j}: {lines[j - 1]}")
print()
PYRepository: kit-data-manager/ro-crate-java
Length of output: 282
🏁 Script executed:
#!/bin/bash
# Get the context around lines 40-80 in gradlew.bat
head -80 gradlew.bat | tail -50Repository: kit-data-manager/ro-crate-java
Length of output: 1695
Add control-flow statements to prevent execution fallthrough after error handling.
"%COMSPEC%" /c exit 1 exits only the child cmd.exe process; the parent batch file continues executing the next statement. Both error paths at lines 54 and 68 lack explicit control-flow directives (goto :eof, exit /b) and will fall through into subsequent code, attempting to execute Gradle with invalid or unset JAVA_EXE instead of stopping at the error.
Proposed fix
echo location of your Java installation. 1>&2
"%COMSPEC%" /c exit 1
+goto :eof
:findJavaFromJavaHome echo location of your Java installation. 1>&2
"%COMSPEC%" /c exit 1
+goto :eof
:execute📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| "%COMSPEC%" /c exit 1 | |
| "%COMSPEC%" /c exit 1 | |
| goto :eof |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@gradlew.bat` at line 54, The error handling code that executes `"%COMSPEC%"
/c exit 1` only terminates the child command process but allows the parent batch
script to continue executing subsequent statements. After each error exit
command in the script, add an explicit control-flow directive such as `goto
:eof` or `exit /b` immediately following the exit statement to prevent execution
fallthrough and ensure the script terminates properly instead of attempting to
run Gradle with invalid or unset variables like JAVA_EXE.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit