feat(android): integrate Lumen Crash SDK and upgrade all dependencies - #5
Conversation
Adopt com.chloemlla.lumen:lumen-crash for crash reporting and startup ANR protection, resolving the latest release instead of hardcoding a version: - settings.gradle.kts: stage SDK artifacts in android/local-maven and gate the GitHub Packages repo behind non-empty gpr.user/gpr.key credentials - app/build.gradle.kts: resolve lumenCrashVersion via gradle property -> LUMEN_CRASH_VERSION env -> lumen-crash.resolved.version file -> error - .github/scripts/fetch-lumen-crash-sdk.py: fetch the latest non-draft lumen-crash-v* release from Chloemlla/Project-Lumen into local-maven with sha256 checksum validation - workflow: resolve/stage the SDK before unit tests, lint, and release build - policy script: assert the new dependency line, fetch script, and env wiring - runtime: enable ANR + startup-hang watchdogs and mark startup complete after the first rendered frame - docs: document the SDK integration in android/README.md
|
Warning Review limit reached
Next review available in: 103 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthrough新增 Lumen Crash SDK 的版本解析和 Maven artifact 暂存流程。Android 构建从 Gradle 属性、环境变量或解析文件读取版本。CI 传递该版本并执行策略校验。应用新增启动完成、ANR 和启动卡顿监控配置。 ChangesLumen Crash SDK 集成
Estimated code review effort: 4 (Complex) | ~45 minutes Mergeability Score: 🔴 Critical · up to The Android build currently cannot configure because the repository credential condition is not valid Kotlin, and the SDK staging flow can continue with missing or mismatched checksums, potentially using an unverified artifact. Merge should be blocked until the build configuration and checksum validation are corrected. Sequence Diagram(s)sequenceDiagram
participant CI
participant GitHub
participant FetchScript
participant Gradle
CI->>FetchScript: 执行 SDK 获取脚本
FetchScript->>GitHub: 获取 release 和 Maven artifacts
FetchScript->>CI: 写入 LUMEN_CRASH_VERSION
CI->>Gradle: 传递 LUMEN_CRASH_VERSION
Gradle->>Gradle: 解析依赖并构建 Android 目标
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
- AGP 8.13.2 -> 9.3.1; Compose BOM 2024.12.01 -> 2026.08.00 - AGP 9 enables built-in Kotlin (KGP 2.2.10), so drop the org.jetbrains.kotlin.android plugin and the kotlin.jvmToolchain helper (jvmTarget follows compileOptions, already VERSION_21) - core-ktx 1.19.0, lifecycle 2.11.0, security-crypto 1.1.0, credentials 1.6.0, googleid 1.2.0, play-services-auth 21.6.0, okhttp 5.4.0, mmkv 2.4.1, camera 1.6.1, org.json 20260719
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/fetch-lumen-crash-sdk.py:
- Around line 81-85: Update the checksum validation in the download/verification
flow to fail immediately when checksums.get(path.name) is missing or
sha256_hex(path.read_bytes()) differs from the expected value, instead of
printing warnings. In the checksum-file handling around the version-processing
logic and checksum output, use a version-specific directory or filename so
releases cannot reuse the shared local-maven/checksums.txt.
In `@android/settings.gradle.kts`:
- Around line 12-17: 在 settings.gradle.kts 的仓库配置中，将 LumenCrashLocal 放到
mavenCentral() 之前，或用 exclusiveContent 将 com.chloemlla.lumen 固定到该本地仓库；同时将 gprUser
和 gprKey 的凭据条件改为 Kotlin 支持的显式非空判断，确保配置可编译。
Apply the same fix in `@android/settings.gradle.kts` at line 20.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7c6492ae-1523-44dc-a545-eb56990e6d00
📒 Files selected for processing (10)
.github/scripts/fetch-lumen-crash-sdk.py.github/scripts/validate-synapse-android-policy.py.github/workflows/synapse-android.ymlandroid/.gitignoreandroid/README.mdandroid/app/build.gradle.ktsandroid/app/src/main/java/com/chloemlla/synapse/mobile/MainActivity.ktandroid/app/src/main/java/com/chloemlla/synapse/mobile/SynapseApplication.ktandroid/build.gradle.ktsandroid/settings.gradle.kts
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Build signed release APK
🧰 Additional context used
🪛 ast-grep (0.45.1)
.github/scripts/fetch-lumen-crash-sdk.py
[warning] 42-42: Request-controlled URL passed to urlopen; validate against an allowlist to prevent SSRF.
Context: urllib.request.urlopen(request, timeout=60)
Note: [CWE-918] Server-Side Request Forgery (SSRF).
(urlopen-unsanitized-data)
🪛 GitHub Actions: Build Synapse Android / 0_Build signed release APK.txt
android/settings.gradle.kts
[error] 16-16: Gradle script compilation failed during 'gradle testProductionDebugUnitTest --no-daemon --warning-mode all': unresolved reference 'resolve' in 'layout.settingsDirectory.resolve("local-maven")'.
[error] 20-20: Gradle script compilation failed: 'gprUser && gprKey' uses String values as Boolean conditions; both conditions have a type mismatch.
🪛 GitHub Actions: Build Synapse Android / Build signed release APK
android/settings.gradle.kts
[error] 16-16: Gradle script compilation failed in 'gradle testProductionDebugUnitTest --no-daemon --warning-mode all': unresolved reference 'resolve' in 'layout.settingsDirectory.resolve("local-maven")'.
[error] 20-20: Gradle script compilation failed: 'gprUser && gprKey' uses String values where Boolean operands are required.
🪛 LanguageTool
android/README.md
[uncategorized] ~30-~30: The official name of this software platform is spelled with a capital “H”.
Context: ...rt UI). The version is never hardcoded: .github/scripts/fetch-lumen-crash-sdk.py resol...
(GITHUB)
🪛 Ruff (0.16.1)
.github/scripts/fetch-lumen-crash-sdk.py
[error] 42-42: Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
(S310)
[error] 43-43: Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
(S310)
[warning] 45-46: try-except within a loop incurs performance overhead
(PERF203)
🔇 Additional comments (8)
android/build.gradle.kts (1)
2-4: LGTM!android/app/build.gradle.kts (1)
5-6: LGTM!Also applies to: 154-194
android/.gitignore (1)
7-9: LGTM!android/app/src/main/java/com/chloemlla/synapse/mobile/MainActivity.kt (1)
11-20: LGTM!Also applies to: 58-61
android/app/src/main/java/com/chloemlla/synapse/mobile/SynapseApplication.kt (1)
56-60: LGTM!android/README.md (1)
26-33: LGTM!.github/scripts/validate-synapse-android-policy.py (1)
56-66: LGTM!.github/workflows/synapse-android.yml (1)
48-53: 🩺 Stability & Availability无需更换暂存步骤的令牌
Chloemlla/Project-Lumen是公开仓库，release 资产可公开下载。暂存步骤使用secrets.GITHUB_TOKEN可以访问这些资产。> Likely an incorrect or invalid review comment.
| expected = checksums.get(path.name) | ||
| if expected is None: | ||
| print(f"warning: no checksum entry for {path.name}", file=sys.stderr) | ||
| elif sha256_hex(path.read_bytes()) != expected: | ||
| print(f"warning: sha256 mismatch for {path.name}", file=sys.stderr) |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
对校验和失败进行硬失败，并按版本保存校验和文件。
Line 83 和 Line 85 只输出警告，因此缺失或不匹配的 SHA-256 不会阻止构建使用已下载的 AAR。
Line 105 还会复用所有版本共享的 local-maven/checksums.txt。解析第二个 release 时，旧校验和文件通常不包含新文件名，脚本只输出警告并写入新版本。
请在缺少条目或哈希不匹配时抛出错误，并将校验和文件存储在版本专属目录中。
Also applies to: 104-107
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/scripts/fetch-lumen-crash-sdk.py around lines 81 - 85, Update the
checksum validation in the download/verification flow to fail immediately when
checksums.get(path.name) is missing or sha256_hex(path.read_bytes()) differs
from the expected value, instead of printing warnings. In the checksum-file
handling around the version-processing logic and checksum output, use a
version-specific directory or filename so releases cannot reuse the shared
local-maven/checksums.txt.
AGP 9's built-in Kotlin bundles KGP 2.2.10, whose compiler can only read metadata up to 2.3.0. The lumen-crash SDK (0.1.0-a76cae4d) is compiled with Kotlin 2.4.0 (kotlin-stdlib 2.4.10), so the metadata mismatch broke the whole app module with Unresolved reference / Incompatible classes errors. Raise the built-in Kotlin compiler to 2.4.10 by declaring the higher KGP on the build classpath (the documented AGP 9 override mechanism) and bump the org.jetbrains.kotlin.plugin.compose version to match (2.4.10). org.jetbrains. kotlin.android is intentionally not applied: it is incompatible with the AGP 9 DSL when built-in Kotlin is enabled.
1 participant
Summary
com.chloemlla.lumen:lumen-crashfor crash reporting + startup ANR protection, resolving the latest release dynamically (never hardcoded):android/settings.gradle.kts: stage SDK artifacts inandroid/local-maven, gate GitHub Packages repo behind non-emptygpr.user/gpr.keyandroid/app/build.gradle.kts: version resolution chainlumenCrashVersionproperty →LUMEN_CRASH_VERSIONenv →lumen-crash.resolved.versionfile → error.github/scripts/fetch-lumen-crash-sdk.py: fetch latest non-draftlumen-crash-v*release assets into local-maven with sha256 validationmarkStartupComplete()after first frameorg.jetbrains.kotlin.androidplugin is dropped.Test plan
gradle testProductionDebugUnitTestpasses in CIgradle lintProductionDebugpasses in CIgradle assembleProductionRelease assembleLegacyReleasebuilds in CISummary by CodeRabbit