ci: migrate lint reporting to SARIF and remove Danger

.github/workflows/ci.yml

@@ -11,25 +11,30 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
           fetch-depth: 100
 
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v5
         with:
-          java-version: '11'
           distribution: 'zulu'
+          java-version: |
+            17
+            21
 
       - name: Validate gradle wrapper
-        uses: gradle/wrapper-validation-action@v1
+        uses: gradle/actions/wrapper-validation@v6
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
-      - name: Gradle Build Cache
-        uses: gradle/gradle-build-action@v2
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Build Debug
         run: ./gradlew clean app:assembleDebug
@@ -38,24 +43,25 @@ jobs:
         if: github.event_name  == 'pull_request'
         run: ./gradlew lintDebug
 
-      - name: Detekt
-        if: github.event_name  == 'pull_request'
-        run: ./gradlew detekt
-
-      - name: Setup Ruby
-        if: github.event_name  == 'pull_request'
-        uses: ruby/setup-ruby@v1
+      - name: Collect Lint SARIF reports
+        if: github.event_name == 'pull_request'
+        run: |
+          mkdir -p sarif-reports
+          find . -name "lint-results-debug.sarif" | while read f; do
+            module=$(echo "$f" | sed 's|^\./||' | sed 's|/build/reports/.*||' | sed 's|/|-|g')
+            cp "$f" "sarif-reports/${module}-lint.sarif"
+          done
+
+      - name: Upload Lint SARIF
+        if: always() && github.event_name == 'pull_request'
+        uses: github/codeql-action/upload-sarif@v4
         with:
-          ruby-version: '3.0'
-          bundler-cache: true
+          sarif_file: 'sarif-reports'
+          category: android-lint
 
-      - name: Run Danger
+      - name: Detekt
         if: github.event_name  == 'pull_request'
-        run: |
-          gem install danger
-          bundle exec danger --dangerfile=Dangerfile --danger_id=danger-pr
-        env:
-          DANGER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./gradlew detekt
 
       - name: Prepare Keystore and Local.
         if: startsWith(github.ref, 'refs/tags/')
@@ -105,7 +111,7 @@ jobs:
           find . -name "*.aab" -type f -exec cp {} "artifacts" \;
 
       - name: Archive Artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v7
         with:
           name: "App-Artifacts"
           path: artifacts/*

.github/workflows/pr-checks.yml

@@ -0,0 +1,29 @@
+name: PR Checks
+
+on:
+  pull_request:
+
+permissions:
+  pull-requests: read
+
+jobs:
+  quality-gates:
+    name: Quality Gates
+    runs-on: ubuntu-latest
+    steps:
+      - name: PR Quality Gates
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number
+            });
+            const labels = pr.labels.map(l => l.name);
+            if (labels.some(l => l.includes('DO NOT MERGE')))
+              core.setFailed('PR specifies label DO NOT MERGE');
+            if (labels.some(l => l.includes('Engineers at work')) || pr.title.includes('[WIP]'))
+              core.warning('PR is marked as Work in Progress');
+            if (pr.additions + pr.deletions > 5000)
+              core.warning('Big PR');

build.gradle

@@ -63,5 +63,20 @@ subprojects {
     dependencies {
         detektPlugins "io.gitlab.arturbosch.detekt:detekt-formatting:${versions.detekt}"
     }
+
+    plugins.withId('com.android.library') {
+        android {
+            lintOptions {
+                sarifReport true
+            }
+        }
+    }
+    plugins.withId('com.android.application') {
+        android {
+            lintOptions {
+                sarifReport true
+            }
+        }
+    }
 }