ci: stabilize the PR gate and fix post-merge issues - #225
Open
Gurupreet wants to merge 3 commits into
Open
Conversation
CI - gradle.properties: 6g daemon heap, workers.max=2, kotlin daemon 2g. The `build` job was dying with OutOfMemoryError in lintAnalyzeDebug and D8 mergeExtDexRelease before any test task ran (#205, #206, #223 all red). - android.yml: PR gate is now assembleDebug + testDebugUnitTest + verifyRoborazziDebug with gradle/actions caching and cancel-in-progress; lint runs in its own job (:app:lintDebug). Debug APK is still uploaded. Roborazzi diffs and test reports are uploaded on failure. - Remove build.yml: duplicated the APK job and could never fail (continue-on-error: true). - Add codeql.yml and dependency-review.yml from #218, with the CodeQL build run with --no-build-cache so the tracer sees real compilations (with the build cache warm every compileKotlin task was FROM-CACHE and CodeQL reported no Java/Kotlin code). Code - moviesapp: TMDB API key was hardcoded in MovieApi.kt. It now comes from BuildConfig.TMDB_API_KEY, read from local.properties (tmdbApiKey) or the TMDB_API_KEY env var. The old key has been public in git history and must be rotated on TMDB. - moviesapp: HTTP body logging only in debug builds. - moviesapp: Coil 3 exposes painter.state as a StateFlow; the `is Success` check in MovieDetailContent never matched, so the poster never expanded. Collect the state and react in a LaunchedEffect. - moviesapp: SimilarMoviesSection fired a network request on every recomposition; now once per movie id via LaunchedEffect. - pinlock: BiometricActivity is no longer exported (no intent filter). - README: JDK 17 / Ladybug, version catalog, TMDB key setup. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Dependabot's first two gradle runs on master failed with "Error processing androidx.paging:paging-compose (RuntimeError) No files changed!". With directories ["/", "/**"] each module directory is updated on its own, but module build files only reference catalog aliases; the version is in gradle/libs.versions.toml at the root. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
actions/dependency-review-action hard-fails with "Dependency review is not supported on this repository" when the graph is off. Probe the SBOM endpoint first and skip with a workflow warning instead, so the check is green until the setting is enabled and starts reviewing automatically afterwards. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
dipenpradhan
self-requested a review
September 14, 2026 03:42
dipenpradhan
approved these changes
Sep 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to the modernization stack (#204–#223, #216, #217). Two groups of changes: make CI reliable and actually run tests, and fix the issues found while reviewing the merged tree.
CI
-Xmx6g,org.gradle.workers.max=2,kotlin.daemon.jvmargs=-Xmx2g. Thebuildjob on Upgrade AndroidX Lifecycle to 2.8.7 #205, Upgrade Navigation Compose to 2.8.9 and adopt type-safe navigation #206 and Add Roborazzi screenshot / golden UI testing #223 died withOutOfMemoryError: Java heap spaceinlintAnalyzeDebug/ D8mergeExtDexReleasebefore any test task ran.android.yml: PR gate is nowassembleDebug testDebugUnitTest verifyRoborazziDebugwithgradle/actions/setup-gradlecaching andcancel-in-progress. Lint runs in its ownlintjob (:app:lintDebug). Debug APK still uploaded; Roborazzi diffs and test reports uploaded on failure. Until now neither unit tests nor screenshot verification had ever executed in CI.build.yml: duplicated the APK job and could never fail (continue-on-error: true).--no-build-cache. With the cache warm everycompileKotlintask wasFROM-CACHE, the tracer saw no compilation, and CodeQL failed with "could not process any code written in Java/Kotlin".dependency-reviewneeds Dependency graph enabled under Settings → Code security; it is currently off (API returns 404) so that check will fail until it is turned on.Code
MovieApi.kt). NowBuildConfig.TMDB_API_KEY, read fromlocal.properties(tmdbApiKey=…) orTMDB_API_KEY. The old key has been in public git history since the original commit and must be rotated on TMDB.painter.stateis aStateFlow; theis Successcheck inMovieDetailContentcould never match, so the poster never expanded. Now collected and applied in aLaunchedEffect.SimilarMoviesSectionfired a network request on every recomposition; now once per movie id.BiometricActivityno longer exported (it has no intent filter).Verified locally
./gradlew assembleDebug testDebugUnitTest verifyRoborazziDebugon master: BUILD SUCCESSFUL,:app,:components:tags,:demos:meditationunit tests and:components:tags:verifyRoborazziDebugexecuted. Same tasks plus:app:lintDebugrunning on this branch.🤖 Generated with Claude Code