diff --git a/docs/AUDIT-2026-10-14.md b/docs/AUDIT-2026-10-14.md index 8aebd7e9..be00d2ab 100644 --- a/docs/AUDIT-2026-10-14.md +++ b/docs/AUDIT-2026-10-14.md @@ -295,5 +295,15 @@ Commits: `086370d` (P0/P1 pass) β†’ `bb3b832` (batches 1–3: app lock, DiffUtil | W10 | 🟑 partial | `scripts/quality-gate.sh` (13 mechanical checks, all passing) + `.github/workflows/quality.yml` (gate, unit tests, compile, lint, APK build path untouched); first JVM unit tests: `ConfigRulesTest` pins the live-tab cap, input-mode resolution, zoom clamping, desktop-UA detection and privacy defaults | Robolectric tests for `PageZoomController`/`ShortcutMgr`/`TabsModel`/`PageTranslate`; APK-size-per-ABI recording in `release.yml` | | W11 | 🟑 blocked on owner | README About-screen URL/e-mail corrected to the real remote, no e-mail shown in-app | The licence contradiction in Β§0 is a legal decision, not a code change: either publish under GPL-3.0-or-later with TV Bro attribution, or re-derive the affected modules | -**Verification status (updated after the first real CI run).** The code was authored in an environment with no JDK and no Android SDK, so it went through CI before it went anywhere else: `.github/workflows/quality.yml` now reports **green** β€” `:app:compileDebugKotlin` + `:app:common:compileDebugKotlin`, `:app:common:testDebugUnitTest` (the 11 new `ConfigRulesTest` cases) and `:app:lintDebug` all pass. The compile earned its keep: it caught 6 defects the static checks could not see β€” `ActivityManager.MemoryInfo` vs `isLowRamDevice()`, three string resources with an unescaped apostrophe, one with a Kotlin `\u2026` escape, a `return@withContext` label left behind by a moved guard, two missing extension imports, and two JVM property/setter signature clashes. **Two of them were already on `main`** (`` in `version_and_updates`, both the default and `zh-rTW` β€” `:app:mergeDebugResources` fails on it), which is what a build gate on every PR is for. +**Verification status (updated after the first real CI run).** The code was authored in an environment with no JDK and no Android SDK, so it went through CI before it went anywhere else: `.github/workflows/quality.yml` reports **green** on `main` β€” `:app:compileDebugKotlin` + `:app:common:compileDebugKotlin`, `:app:common:testDebugUnitTest` (the 11 new `ConfigRulesTest` cases) and `:app:lintDebug`. The compile earned its keep: it caught six defects the static checks could not see β€” `ActivityManager.isLowRamDevice()` (not `MemoryInfo.isLowRamDevice`), three string resources with an unescaped apostrophe, a `return@withContext` label left behind by a moved guard, two missing extension imports, and two JVM property/setter signature clashes. + +> **One of my own diagnoses there was wrong and is recorded so it does not get repeated.** The first +> resource failure (`Can not extract resource from ParsedResource` Γ—3) I blamed on the +> `` strings and wrote that `main` had not built since `3c3f210`. It +> had: `build_apk.yml` completed successfully for `3c3f210` *and* for the merge of PR #1. The three +> unextractable resources were the three apostrophe strings (the count matched all along); aapt2 +> accepts both CDATA and `\uXXXX`. The CDATAβ†’`&` edit is therefore cosmetic (identical rendered +> text), and the gate keeps a CDATA check for the one *real* trap: inside CDATA, `\n`/`\'` are taken +> literally, so escapes silently stop working. + Still owed before this is called production-ready: a real phone (portrait 360dp) + real TV-box run of the Β§6 checklist in `AGENTS.md`, and an APK-size measurement to back the README number. diff --git a/scripts/quality-gate.sh b/scripts/quality-gate.sh index 03c9ff8b..e63094a5 100755 --- a/scripts/quality-gate.sh +++ b/scripts/quality-gate.sh @@ -123,8 +123,11 @@ EOF ) report "string resources escape apostrophes and avoid unicode escapes" "$esc" -# CDATA inside a is a hard aapt2 failure ("Can not extract resource from ParsedResource"), -# so escaped entities are the only legal way to carry & or < in a resource. +# Prefer entities over CDATA in value resources: aapt2 accepts CDATA, but it also disables aapt's +# escape handling inside it (a \n or \' in a CDATA block reaches the user literally), which is a +# silent-trap in a file where the other 660 strings rely on escapes. Found while chasing a real +# "Can not extract resource" failure β€” which turned out to be unescaped apostrophes, not CDATA. +# (Yes, the first version of this comment blamed the wrong thing; keep the diagnosis honest.) cdata=$(grep -rn 'CDATA' app/src/main/res/values* app/common/src/main/res/values* 2>/dev/null || true) report "no CDATA in resource values" "$cdata"