Merge pull request #1061 from mikepenz/ci/sarif-lint

ci: migrate lint reporting to SARIF and remove Danger

Author: mikepenz

.github/workflows/ci.yml

@@ -11,25 +11,28 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
           fetch-depth: 100
 
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v5
         with:
-          java-version: '11'
           distribution: 'zulu'
+          java-version: '17'
 
       - name: Validate gradle wrapper
-        uses: gradle/wrapper-validation-action@v1
+        uses: gradle/actions/wrapper-validation@v6
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
-      - name: Gradle Build Cache
-        uses: gradle/gradle-build-action@v2
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Build Debug
         run: ./gradlew clean app:assembleDebug
@@ -38,24 +41,86 @@ jobs:
         if: github.event_name  == 'pull_request'
         run: ./gradlew lintDebug
 
-      - name: Detekt
-        if: github.event_name  == 'pull_request'
-        run: ./gradlew detekt
+      - name: Upload Lint SARIF (fastadapter)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('fastadapter/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: 'fastadapter/build/reports/lint-results-debug.sarif'
+          category: android-lint-fastadapter
 
-      - name: Setup Ruby
-        if: github.event_name  == 'pull_request'
-        uses: ruby/setup-ruby@v1
+      - name: Upload Lint SARIF (fastadapter-extensions-binding)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('fastadapter-extensions-binding/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: 'fastadapter-extensions-binding/build/reports/lint-results-debug.sarif'
+          category: android-lint-fastadapter-extensions-binding
+
+      - name: Upload Lint SARIF (fastadapter-extensions-diff)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('fastadapter-extensions-diff/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
         with:
-          ruby-version: '3.0'
-          bundler-cache: true
+          sarif_file: 'fastadapter-extensions-diff/build/reports/lint-results-debug.sarif'
+          category: android-lint-fastadapter-extensions-diff
 
-      - name: Run Danger
+      - name: Upload Lint SARIF (fastadapter-extensions-drag)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('fastadapter-extensions-drag/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: 'fastadapter-extensions-drag/build/reports/lint-results-debug.sarif'
+          category: android-lint-fastadapter-extensions-drag
+
+      - name: Upload Lint SARIF (fastadapter-extensions-expandable)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('fastadapter-extensions-expandable/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: 'fastadapter-extensions-expandable/build/reports/lint-results-debug.sarif'
+          category: android-lint-fastadapter-extensions-expandable
+
+      - name: Upload Lint SARIF (fastadapter-extensions-paged)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('fastadapter-extensions-paged/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: 'fastadapter-extensions-paged/build/reports/lint-results-debug.sarif'
+          category: android-lint-fastadapter-extensions-paged
+
+      - name: Upload Lint SARIF (fastadapter-extensions-scroll)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('fastadapter-extensions-scroll/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: 'fastadapter-extensions-scroll/build/reports/lint-results-debug.sarif'
+          category: android-lint-fastadapter-extensions-scroll
+
+      - name: Upload Lint SARIF (fastadapter-extensions-swipe)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('fastadapter-extensions-swipe/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: 'fastadapter-extensions-swipe/build/reports/lint-results-debug.sarif'
+          category: android-lint-fastadapter-extensions-swipe
+
+      - name: Upload Lint SARIF (fastadapter-extensions-ui)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('fastadapter-extensions-ui/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: 'fastadapter-extensions-ui/build/reports/lint-results-debug.sarif'
+          category: android-lint-fastadapter-extensions-ui
+
+      - name: Upload Lint SARIF (fastadapter-extensions-utils)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('fastadapter-extensions-utils/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: 'fastadapter-extensions-utils/build/reports/lint-results-debug.sarif'
+          category: android-lint-fastadapter-extensions-utils
+
+      - name: Upload Lint SARIF (app)
+        if: (success() || failure()) && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && hashFiles('app/build/reports/lint-results-debug.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: 'app/build/reports/lint-results-debug.sarif'
+          category: android-lint-app
+
+      - name: Detekt
         if: github.event_name  == 'pull_request'
-        run: |
-          gem install danger
-          bundle exec danger --dangerfile=Dangerfile --danger_id=danger-pr
-        env:
-          DANGER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./gradlew detekt
 
       - name: Prepare Keystore and Local.
         if: startsWith(github.ref, 'refs/tags/')
@@ -105,7 +170,7 @@ jobs:
           find . -name "*.aab" -type f -exec cp {} "artifacts" \;
 
       - name: Archive Artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v7
         with:
           name: "App-Artifacts"
           path: artifacts/*

.github/workflows/pr-checks.yml

@@ -0,0 +1,36 @@
+name: PR Checks
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
+      - edited
+
+permissions:
+  pull-requests: read
+
+jobs:
+  quality-gates:
+    name: Quality Gates
+    runs-on: ubuntu-latest
+    steps:
+      - name: PR Quality Gates
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number
+            });
+            const labels = pr.labels.map(l => l.name);
+            if (labels.some(l => l.includes('DO NOT MERGE')))
+              core.setFailed('PR specifies label DO NOT MERGE');
+            if (labels.some(l => l.includes('Engineers at work')) || pr.title.includes('[WIP]'))
+              core.warning('PR is marked as Work in Progress');
+            if (pr.additions + pr.deletions > 5000)
+              core.warning('Big PR');

Dangerfile

@@ -63,5 +63,20 @@ subprojects {
     dependencies {
         detektPlugins "io.gitlab.arturbosch.detekt:detekt-formatting:${versions.detekt}"
     }
+
+    plugins.withId('com.android.library') {
+        android {
+            lintOptions {
+                sarifReport true
+            }
+        }
+    }
+    plugins.withId('com.android.application') {
+        android {
+            lintOptions {
+                sarifReport true
+            }
+        }
+    }
 }