BOM_1.4.10

[jakubuid]

No description provided.

[claude]

Claude finished @jakubuid's task —— View job

---

🔍 PR Review: BOM_1.4.10

This BOM version bump PR contains extensive changes across 46 files with consistent version updates to 1.4.10. Here's my comprehensive review:

✅ Positive Aspects:

Version Consistency: All SDK modules properly updated to 1.4.10 across:

• buildSrc/src/main/kotlin/Versions.kt: All version constants correctly set
• BOM structure maintains proper dependency management
• Sample applications correctly reference the new BOM version

Dependency Management:

• Proper BOM usage in sample apps (sample/*/build.gradle.kts:113-115)
• Clean separation between debug/internal (project references) vs release (BOM references)
• Gradle wrapper updated to 8.13 for improved build performance

Infrastructure Improvements:

• Added Claude auto-review workflow for automated PR reviews
• Added CTA assistant for contributor guidance
• GitHub Actions updated with latest action versions (v4, v5)

🚨 Security & Quality Issues:

1. Secrets Exposure Risk ⚠️

File: build.gradle.kts:118-128

stagingProfileId.set(System.getenv("REOWN_SONATYPE_STAGING_PROFILE_ID"))
username.set(System.getenv("CENTRAL_PORTAL_USERNAME"))
password.set(System.getenv("CENTRAL_PORTAL_PASSWORD"))

Issue: While using environment variables is correct, ensure these are properly secured in CI/CD and not logged.

2. Network Configuration Concerns ⚠️

File: build.gradle.kts:219-220, 279-280

.setConnectTimeout(30000) // 30 seconds
.setSocketTimeout(60000) // 60 seconds

Issue: Long timeout values (60s) could cause hanging builds. Consider reducing to 15-30s for staging operations.

3. JSON Parsing Without Library ⚠️

File: build.gradle.kts:236-260

// Simple JSON parsing - in a real implementation you might want to use a proper JSON library
val repoPattern = """"key":\s*"([^"]+)".*?"state":\s*"([^"]+)".*?(?:"portal_deployment_id":\s*"([^"]*)")?""".toRegex()

Issue: Manual regex-based JSON parsing is error-prone and fragile. Consider using Moshi or Gson for robust JSON handling in production release scripts.

4. Workflow Security ⚠️

File: .github/workflows/claude-review.yml:32

uses: WalletConnect/actions/claude/auto-review@master

Issue: Using @master instead of pinned version creates supply chain risk. Recommend pinning to specific SHA or tag.

File: .github/workflows/cta.yml:19

uses: walletconnect/actions/github/cta-assistant@master

Same issue: Should pin to specific version.

5. Missing Error Handling

File: build.gradle.kts:307-310, 361-362
Exception handling prints stack traces but continues execution. Consider if some failures should halt the release process.

📋 Additional Observations:

Cleanup Operations:

• Removed 9 test resource files from buildSrc/src/test/resources/ (427 lines deleted)
• This appears to be legitimate cleanup of unused test fixtures

Version Management:

• AGP updated to 8.12.2 - latest stable version ✅
• Kotlin updated to 2.2.0 - good for latest language features ✅
• All dependencies properly aligned

Sample App Integration:

• Proper buildConfig field injection: buildConfigField("String", "BOM_VERSION", "\"${BOM_VERSION}\"")
• Correct conditional dependency declarations for different build variants

🔧 Recommendations:

1. Immediate: Pin GitHub Action versions to specific SHAs or tags
2. Soon: Replace manual JSON parsing with proper library (Moshi/Gson)
3. Consider: Reduce HTTP timeout values in staging operations
4. Monitor: Ensure release script error handling meets requirements

📊 Overall Assessment:

This is a well-structured BOM release with consistent versioning across all modules. The version bump appears properly coordinated, and the cleanup of test resources is appropriate. Main concerns are around the release automation scripts and workflow security practices.

Recommendation: APPROVE with above security improvements addressed in follow-up PRs.

---

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud