build: update dependencies and Gradle configurations - #225
Merged
Conversation
Contributor
评审指南此 PR 通过提升 SDK 和插件版本、升级依赖项、精简 CI 工作流以及增强 Maven 发布配置，使项目的构建环境现代化。 更新后的 Maven 发布属性的实体关系图erDiagram
PROJECT ||--o| MAVEN_PUBLISHING : configures
MAVEN_PUBLISHING {
string GROUP
string VERSION_NAME
string POM_NAME
string POM_URL
string POM_DESCRIPTION
string POM_LICENSE_NAME
string POM_LICENSE_URL
string POM_DEVELOPER_ID
string POM_DEVELOPER_NAME
string POM_DEVELOPER_URL
bool signAllPublications
bool mavenCentralPublishing
bool mavenCentralAutomaticPublishing
}
PROJECT {
string name
string path
}
Maven 发布版本验证的流程图flowchart TD
A[Start Maven Publishing] --> B{Is VERSION_NAME set and not '1.0'?}
B -- No --> C[Throw GradleException: version_name cannot be 1.0]
B -- Yes --> D[Continue with coordinates setup]
D --> E[Publish to Maven Central]
文件级更改
提示和命令与 Sourcery 交互
自定义您的体验访问您的 仪表板 以：
获取帮助Original review guide in EnglishReviewer's GuideThis PR modernizes the project’s build environment by bumping SDK and plugin versions, upgrading dependencies, streamlining CI workflows, and enhancing Maven publishing configurations. Entity relationship diagram for updated Maven publishing propertieserDiagram
PROJECT ||--o| MAVEN_PUBLISHING : configures
MAVEN_PUBLISHING {
string GROUP
string VERSION_NAME
string POM_NAME
string POM_URL
string POM_DESCRIPTION
string POM_LICENSE_NAME
string POM_LICENSE_URL
string POM_DEVELOPER_ID
string POM_DEVELOPER_NAME
string POM_DEVELOPER_URL
bool signAllPublications
bool mavenCentralPublishing
bool mavenCentralAutomaticPublishing
}
PROJECT {
string name
string path
}
Flow diagram for Maven publishing version validationflowchart TD
A[Start Maven Publishing] --> B{Is VERSION_NAME set and not '1.0'?}
B -- No --> C[Throw GradleException: version_name cannot be 1.0]
B -- Yes --> D[Continue with coordinates setup]
D --> E[Publish to Maven Central]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
您好 - 我已审阅您的更改 - 以下是一些反馈：
阻塞性问题：
- 源自 GitHub 上第三方仓库的操作未固定到完整的提交 SHA。将操作固定到完整的提交 SHA 是目前将操作用作不可变发布的唯一方法。固定到特定的 SHA 有助于减轻恶意行为者在操作仓库中添加后门的风险，因为他们需要为有效的 Git 对象负载生成 SHA-1 碰撞。(链接)
- 源自 GitHub 上第三方仓库的操作未固定到完整的提交 SHA。将操作固定到完整的提交 SHA 是目前将操作用作不可变发布的唯一方法。固定到特定的 SHA 有助于减轻恶意行为者在操作仓库中添加后门的风险，因为他们需要为有效的 Git 对象负载生成 SHA-1 碰撞。(链接)
一般评论：
- 考虑使用最新的稳定版 Gradle 分发，而不是 9.0-milestone，以避免潜在的构建不稳定。
- 仔细检查从 AndroidManifest 文件中删除
package属性是否会破坏 manifest 合并或 provider 权限解析。 - 验证您的发布工作流始终具有有效的
VERSION_NAME（例如，当github.event.release.tag_name未设置时的回退或解析）以防止 Maven 发布失败。
AI 代理提示
请处理此代码审查中的评论：
## 总体评论
- 考虑使用最新的稳定版 Gradle 分发，而不是 9.0-milestone，以避免潜在的构建不稳定。
- 仔细检查从 AndroidManifest 文件中删除 `package` 属性是否会破坏 manifest 合并或 provider 权限解析。
- 验证您的发布工作流始终具有有效的 `VERSION_NAME`（例如，当 `github.event.release.tag_name` 未设置时的回退或解析）以防止 Maven 发布失败。
## 单独评论
### 评论 1
<location> `floatingx/build.gradle:9` </location>
<code_context>
mavenPublishing {
- coordinates("io.github.petterpx", "floatingx", version_name)
+ def versionName = project.hasProperty('VERSION_NAME') ? project.getProperty('VERSION_NAME') : project.getProperty('version_name')
+ if (versionName == null || version == '1.0') throw new GradleException("version_name cannot be 1.0, please set a valid version name.")
+ coordinates("io.github.petterpx", "floatingx", versionName)
}
</code_context>
<issue_to_address>
版本名称检查使用了 'version' 而不是 'versionName'，这可能无法按预期工作。
考虑更新条件以检查 'versionName == "1.0"'，以确保验证正确的属性。
</issue_to_address>
### 评论 2
<location> `floatingx_compose/build.gradle:9` </location>
<code_context>
mavenPublishing {
- coordinates("io.github.petterpx", "floatingx", version_name)
+ def versionName = project.hasProperty('VERSION_NAME') ? project.getProperty('VERSION_NAME') : project.getProperty('version_name')
+ if (versionName == null || version == '1.0') throw new GradleException("version_name cannot be 1.0, please set a valid version name.")
+ coordinates("io.github.petterpx", "floatingx", versionName)
}
</code_context>
<issue_to_address>
版本名称验证检查了 'version' 而不是 'versionName'，这可能不正确。
条件是否应该检查 'versionName == "1.0"' 而不是 'version == "1.0"' 来验证预期的属性？
</issue_to_address>
## 安全问题
### 问题 1
<location> `.github/workflows/android.yml:17` </location>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** 源自 GitHub 上第三方仓库的操作未固定到完整的提交 SHA。将操作固定到完整的提交 SHA 是目前将操作用作不可变发布的唯一方法。固定到特定的 SHA 有助于减轻恶意行为者在操作仓库中添加后门的风险，因为他们需要为有效的 Git 对象负载生成 SHA-1 碰撞。
*来源: opengrep*
</issue_to_address>
### 问题 2
<location> `.github/workflows/publish_maven.yml:17` </location>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** 源自 GitHub 上第三方仓库的操作未固定到完整的提交 SHA。将操作固定到完整的提交 SHA 是目前将操作用作不可变发布的唯一方法。固定到特定的 SHA 有助于减轻恶意行为者在操作仓库中添加后门的风险，因为他们需要为有效的 Git 对象负载生成 SHA-1 碰撞。
*来源: opengrep*
</issue_to_address>请帮助我更有用！请点击每个评论旁边的 👍 或 👎，我将使用这些反馈来改进您的评论。
Original comment in English
Hey there - I've reviewed your changes - here's some feedback:
Blocking issues:
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
General comments:
- Consider using the latest stable Gradle distribution instead of the 9.0-milestone to avoid potential build instability.
- Double-check that removing the
packageattribute from your AndroidManifest files doesn’t break manifest merging or provider authority resolution. - Verify your publish workflow always has a valid
VERSION_NAME(e.g. fallback or parsing whengithub.event.release.tag_nameisn’t set) to prevent Maven publishing failures.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider using the latest stable Gradle distribution instead of the 9.0-milestone to avoid potential build instability.
- Double-check that removing the `package` attribute from your AndroidManifest files doesn’t break manifest merging or provider authority resolution.
- Verify your publish workflow always has a valid `VERSION_NAME` (e.g. fallback or parsing when `github.event.release.tag_name` isn’t set) to prevent Maven publishing failures.
## Individual Comments
### Comment 1
<location> `floatingx/build.gradle:9` </location>
<code_context>
mavenPublishing {
- coordinates("io.github.petterpx", "floatingx", version_name)
+ def versionName = project.hasProperty('VERSION_NAME') ? project.getProperty('VERSION_NAME') : project.getProperty('version_name')
+ if (versionName == null || version == '1.0') throw new GradleException("version_name cannot be 1.0, please set a valid version name.")
+ coordinates("io.github.petterpx", "floatingx", versionName)
}
</code_context>
<issue_to_address>
The version name check uses 'version' instead of 'versionName', which may not behave as intended.
Consider updating the conditional to check 'versionName == "1.0"' to ensure the correct property is validated.
</issue_to_address>
### Comment 2
<location> `floatingx_compose/build.gradle:9` </location>
<code_context>
mavenPublishing {
- coordinates("io.github.petterpx", "floatingx", version_name)
+ def versionName = project.hasProperty('VERSION_NAME') ? project.getProperty('VERSION_NAME') : project.getProperty('version_name')
+ if (versionName == null || version == '1.0') throw new GradleException("version_name cannot be 1.0, please set a valid version name.")
+ coordinates("io.github.petterpx", "floatingx", versionName)
}
</code_context>
<issue_to_address>
The version name validation checks 'version' instead of 'versionName', which may not be correct.
Should the condition check 'versionName == "1.0"' instead of 'version == "1.0"' to validate the intended property?
</issue_to_address>
## Security Issues
### Issue 1
<location> `.github/workflows/android.yml:17` </location>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>
### Issue 2
<location> `.github/workflows/publish_maven.yml:17` </location>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+9
to
+10
| def versionName = project.hasProperty('VERSION_NAME') ? project.getProperty('VERSION_NAME') : project.getProperty('version_name') | ||
| if (versionName == null || version == '1.0') throw new GradleException("version_name cannot be 1.0, please set a valid version name.") |
Contributor
There was a problem hiding this comment.
issue (bug_risk): 版本名称检查使用了 'version' 而不是 'versionName'，这可能无法按预期工作。
考虑更新条件以检查 'versionName == "1.0"'，以确保验证正确的属性。
Original comment in English
issue (bug_risk): The version name check uses 'version' instead of 'versionName', which may not behave as intended.
Consider updating the conditional to check 'versionName == "1.0"' to ensure the correct property is validated.
Comment on lines
+9
to
+10
| def versionName = project.hasProperty('VERSION_NAME') ? project.getProperty('VERSION_NAME') : project.getProperty('version_name') | ||
| if (versionName == null || version == '1.0') throw new GradleException("version_name cannot be 1.0, please set a valid version name.") |
Contributor
There was a problem hiding this comment.
issue (bug_risk): 版本名称验证检查了 'version' 而不是 'versionName'，这可能不正确。
条件是否应该检查 'versionName == "1.0"' 而不是 'version == "1.0"' 来验证预期的属性？
Original comment in English
issue (bug_risk): The version name validation checks 'version' instead of 'versionName', which may not be correct.
Should the condition check 'versionName == "1.0"' instead of 'version == "1.0"' to validate the intended property?
| java-version: '11' | ||
| distribution: 'adopt' | ||
| - uses: burrunan/gradle-cache-action@v1 | ||
| - uses: burrunan/gradle-cache-action@v3 |
Contributor
There was a problem hiding this comment.
security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): 源自 GitHub 上第三方仓库的操作未固定到完整的提交 SHA。将操作固定到完整的提交 SHA 是目前将操作用作不可变发布的唯一方法。固定到特定的 SHA 有助于减轻恶意行为者在操作仓库中添加后门的风险，因为他们需要为有效的 Git 对象负载生成 SHA-1 碰撞。
来源: opengrep
Original comment in English
security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: opengrep
| java-version: '11' | ||
| distribution: 'adopt' | ||
| - uses: burrunan/gradle-cache-action@v1 | ||
| - uses: burrunan/gradle-cache-action@v3 |
Contributor
There was a problem hiding this comment.
security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): 源自 GitHub 上第三方仓库的操作未固定到完整的提交 SHA。将操作固定到完整的提交 SHA 是目前将操作用作不可变发布的唯一方法。固定到特定的 SHA 有助于减轻恶意行为者在操作仓库中添加后门的风险，因为他们需要为有效的 Git 对象负载生成 SHA-1 碰撞。
来源: opengrep
Original comment in English
security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: opengrep
added 9 commits
August 23, 2025 10:09
… steps in CI configuration
…oved compatibility
…Gradle publishing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sourcery 总结
更新项目构建系统和依赖，提升 SDK 和插件版本，并现代化 CI 工作流以支持 Maven 发布
改进：
构建：
CI：
Original summary in English
Summary by Sourcery
Update project build system and dependencies, bump SDK and plugin versions, and modernize CI workflows for Maven publishing
Enhancements:
Build:
CI: