Repository navigation
chore(ci): replace Danger with GitHub Actions native PR checks and SARIF - #1315
Conversation
- Remove Ruby/Bundler/Danger dependency from CI entirely - Replace danger-android_lint inline comments with github/codeql-action/upload-sarif using a collect step that gathers all lint-results-debug.sarif files - Replace Dangerfile PR quality gates with lightweight actions/github-script step in pr-checks.yml - Add contents: read and security-events: write permissions to build job - Add pull-requests: read permission to pr-checks.yml - Fix double-space whitespace in event_name conditions - Delete Dangerfile, Gemfile, Gemfile.lock
There was a problem hiding this comment.
Pull request overview
This PR removes the repo’s Ruby/Danger-based PR checks and replaces them with GitHub Actions-native checks, including uploading Android Lint results via SARIF and implementing lightweight PR “quality gates” in a dedicated workflow.
Changes:
- Removed Danger/Bundler configuration (
Dangerfile,Gemfile,Gemfile.lock) and the CI steps that executed Danger. - Added a new
pr-checks.ymlworkflow that enforces WIP / DO NOT MERGE / big-PR gates usingactions/github-script. - Updated CI to collect Android Lint SARIF reports across modules and upload them via
github/codeql-action/upload-sarif.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
settings.gradle.kts |
Bumps the shared version catalog dependency version. |
Gemfile.lock |
Removes Ruby dependency lockfile as Danger is removed. |
Gemfile |
Removes Ruby gem dependencies for Danger plugins. |
Dangerfile |
Removes legacy Danger-based PR gates and inline lint/detekt reporting. |
.github/workflows/pr-checks.yml |
Adds PR quality gates via GitHub Script. |
.github/workflows/ci.yml |
Uploads Android Lint SARIF reports and adds required job permissions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Collect Lint SARIF reports | ||
| if: github.event_name == 'pull_request' | ||
| run: | | ||
| gem install danger | ||
| bundle exec danger --dangerfile=Dangerfile --danger_id=danger-pr | ||
| env: | ||
| DANGER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| mkdir -p sarif-reports | ||
| find . -name "lint-results-debug.sarif" | while read f; do | ||
| module=$(echo "$f" | sed 's|^\./||' | sed 's|/build/reports/.*||' | sed 's|/|-|g') | ||
| cp "$f" "sarif-reports/${module}-lint.sarif" | ||
| done | ||
|
|
||
| - name: Upload Lint SARIF | ||
| if: always() && github.event_name == 'pull_request' | ||
| uses: github/codeql-action/upload-sarif@v4 | ||
| with: | ||
| sarif_file: 'sarif-reports' | ||
| category: android-lint |
There was a problem hiding this comment.
The SARIF upload step will run even when no lint-results-debug.sarif files were generated (e.g., if SARIF output isn’t enabled or lint fails early). In that case upload-sarif is likely to fail and obscure the original lint failure. Consider gating the upload on at least one collected SARIF file (or making the collection step emit a boolean output and using it in the if:).
| env: | ||
| DANGER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| mkdir -p sarif-reports | ||
| find . -name "lint-results-debug.sarif" | while read f; do |
There was a problem hiding this comment.
find ... | while read f; do will mis-handle paths containing backslashes or leading/trailing whitespace, and can mangle filenames with spaces. Use while IFS= read -r f; do (and ideally find ... -print0 with a NUL-safe loop) to make the collection robust.
| find . -name "lint-results-debug.sarif" | while read f; do | |
| find . -name "lint-results-debug.sarif" -print0 | while IFS= read -r -d '' f; do |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Summary
danger-android_lintinline comments withgithub/codeql-action/upload-sarif@v4, uploading SARIF reports from all Android modulesDangerfilePR quality gates (WIP, DO NOT MERGE, big PR) with a lightweightactions/github-script@v8step in a newpr-checks.ymlworkflowpermissionsblocks (contents: read,security-events: writeonbuildjob;pull-requests: readonpr-checks.yml)Dangerfile,Gemfile,Gemfile.lockMirrors changes from mikepenz/multiplatform-markdown-renderer#522.
Test plan
**/build/reports/lint-results-debug.sarifpr-checks.ymlquality gates fire correctly for WIP/DO NOT MERGE labels