Skip to content

Conversation

@N6REJ
Copy link
Collaborator

@N6REJ N6REJ commented Nov 12, 2025

PR Type

Enhancement


Description

  • Migrate build system from Ant to Gradle with modern tooling

  • Add comprehensive Gradle documentation with architecture details

  • Implement GitHub Actions CI/CD workflow for automated builds

  • Configure Gradle properties for performance and caching


Diagram Walkthrough

flowchart LR
  A["Ant Build System<br/>build.xml"] -->|"Migrate"| B["Gradle Build System<br/>build.gradle"]
  B -->|"Configure"| C["gradle.properties<br/>JVM & Caching"]
  B -->|"Automate"| D["GitHub Actions<br/>gradle-build.yml"]
  B -->|"Document"| E[".gradle-docs/README.md<br/>Complete Guide"]
  D -->|"Build & Test"| F["Release Artifacts<br/>7z Archives"]
Loading

File Walkthrough

Relevant files
Configuration changes
2 files
gradle-build.yml
Add GitHub Actions CI/CD workflow for Gradle builds           
+93/-0   
gradle.properties
Add Gradle configuration for JVM and build optimization   
+9/-0     
Documentation
2 files
README.md
Comprehensive Gradle build documentation and migration guide
+461/-0 
README.md
Add Gradle quick start guide to main README                           
+30/-0   
Enhancement
1 files
build.xml
Remove legacy Ant build configuration file                             
+0/-38   
Additional files
22 files
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   
bearsampp.conf [link]   

@qodo-code-review
Copy link

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: build

Failed stage: Show build info [❌]

Failure summary:

The GitHub Action failed because the Gradle task buildInfo does not exist in the root project
module-git.
- Gradle output: "Task buildInfo not found in root project module-git." (lines 201–204)

- The workflow step ran gradle buildInfo, which caused Gradle to exit with code 1 since that task is
undefined (likely missing plugin or incorrect task name).

Relevant error logs:
1:  ##[group]Runner Image Provisioner
2:  Hosted Compute Agent
...

132:  cache-overwrite-existing: false
133:  gradle-home-cache-includes: caches
134:  notifications
135:  
136:  gradle-home-cache-cleanup: false
137:  generate-job-summary: true
138:  dependency-graph: disabled
139:  gradle-home-cache-strict-match: false
140:  workflow-job-context: null
141:  github-token: ***
142:  env:
143:  JAVA_HOME: C:\hostedtoolcache\windows\Java_Temurin-Hotspot_jdk\17.0.17-10\x64
144:  JAVA_HOME_17_X64: C:\hostedtoolcache\windows\Java_Temurin-Hotspot_jdk\17.0.17-10\x64
145:  ##[endgroup]
146:  ##[group]Restore Gradle state from cache
147:  ##[warning]Failed to restore v8-gradle|Windows|gradle build-build[37a6259cc0c1dae299a7866489dff0bd]-7673cfcfdb113160b4cf9fedbc027b187ae4a56a: Error: Cache service responded with 400
148:  Gradle User Home cache not found. Will initialize empty.
149:  ##[endgroup]
150:  ##[group]Provision Gradle 8.5
151:  ##[warning]Restore Gradle distribution 8.5 failed: Error: Cache service responded with 400
152:  Gradle distribution 8.5 not found in cache. Will download.
153:  Downloaded https://services.gradle.org/distributions/gradle-8.5-bin.zip to C:\Users\runneradmin\gradle-installations\downloads\gradle-8.5-bin.zip (size 132519731)
154:  [command]"C:\Program Files\PowerShell\7\pwsh.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command "$ErrorActionPreference = 'Stop' ; try { Add-Type -AssemblyName System.IO.Compression.ZipFile } catch { } ; try { [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\runneradmin\gradle-installations\downloads\gradle-8.5-bin.zip', 'C:\Users\runneradmin\gradle-installations\installs', $true) } catch { if (($_.Exception.GetType().FullName -eq 'System.Management.Automation.MethodException') -or ($_.Exception.GetType().FullName -eq 'System.Management.Automation.RuntimeException') ){ Expand-Archive -LiteralPath 'C:\Users\runneradmin\gradle-installations\downloads\gradle-8.5-bin.zip' -DestinationPath 'C:\Users\runneradmin\gradle-installations\installs' -Force } else { throw $_ } } ;"
155:  Extracted Gradle 8.5 to C:\Users\runneradmin\gradle-installations\installs\gradle-8.5
...

181:  Chocolatey installed 1/1 packages. 
182:  See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).
183:  ##[group]Run gradle buildInfo
184:  �[36;1mgradle buildInfo�[0m
185:  shell: C:\Program Files\PowerShell\7\pwsh.EXE -command ". '{0}'"
186:  env:
187:  JAVA_HOME: C:\hostedtoolcache\windows\Java_Temurin-Hotspot_jdk\17.0.17-10\x64
188:  JAVA_HOME_17_X64: C:\hostedtoolcache\windows\Java_Temurin-Hotspot_jdk\17.0.17-10\x64
189:  GRADLE_BUILD_ACTION_SETUP_COMPLETED: true
190:  GRADLE_BUILD_ACTION_CACHE_RESTORED: true
191:  ##[endgroup]
192:  Welcome to Gradle 8.5!
193:  Here are the highlights of this release:
194:  - Support for running on Java 21
195:  - Faster first use with Kotlin DSL
196:  - Improved error and warning messages
197:  For more details see https://docs.gradle.org/8.5/release-notes.html
198:  Starting a Gradle Daemon (subsequent builds will be faster)
199:  Configuration on demand is an incubating feature.
200:  FAILURE: Build failed with an exception.
201:  * What went wrong:
202:  Task 'buildInfo' not found in root project 'module-git'.
203:  * Try:
204:  > Run gradle tasks to get a list of available tasks.
205:  > For more on name expansion, please refer to https://docs.gradle.org/8.5/userguide/command_line_interface.html#sec:name_abbreviation in the Gradle documentation.
206:  > Run with --stacktrace option to get the stack trace.
207:  > Run with --info or --debug option to get more log output.
208:  > Run with --scan to get full insights.
209:  > Get more help at https://help.gradle.org.
210:  BUILD FAILED in 28s
211:  ##[error]Process completed with exit code 1.
212:  Post job cleanup.

@qodo-code-review
Copy link

qodo-code-review bot commented Nov 12, 2025

PR Compliance Guide 🔍

(Compliance updated until commit 16084f4)

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Missing audit logs: The new CI workflow performs critical build and artifact upload actions without emitting
any structured audit logs that capture actor, timestamp, action, and outcome, which may be
handled by GitHub Actions automatically but is not evident in the code changes.

Referred Code
jobs:
  build:
    runs-on: windows-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin'

    - name: Setup Gradle
      uses: gradle/gradle-build-action@v2
      with:
        gradle-version: 8.5

    - name: Install 7-Zip
      run: |


 ... (clipped 63 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
No failure handling: The workflow steps rely on default failure behavior without retries or explicit error
handling for external dependencies (e.g., choco install, downloads), which may be
acceptable in CI but lacks robustness indications in the added code.

Referred Code
- name: Install 7-Zip
  run: |
    choco install 7zip -y
    echo "C:\Program Files\7-Zip" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

- name: Show build info
  run: gradle buildInfo

- name: List available versions
  run: gradle listVersions

- name: Verify bundle structure
  run: gradle verifyBundle

- name: Build release
  run: gradle buildRelease

- name: Upload artifacts
  uses: actions/upload-artifact@v4
  with:
    name: bearsampp-git-release


 ... (clipped 37 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Unstructured logs: The workflow prints unstructured console output and lists artifact paths and sizes, which
is not sensitive itself but does not implement structured logging or safeguards against
accidental leakage in logs.

Referred Code
- name: Display build output
  run: |
    Write-Host "Build completed successfully!"
    Write-Host "Output files:"
    Get-ChildItem ../bearsampp-build/tools/git/ -Recurse -Filter *.7z | ForEach-Object {
      Write-Host "  - $($_.FullName) ($([math]::Round($_.Length / 1MB, 2)) MB)"
    }

Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

Previous compliance checks

Compliance check up to commit 7673cfc
Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Missing audit logs: The newly added build scripts and docs do not implement logging of critical actions (e.g.,
downloads, extractions, permission changes) with user IDs and outcomes; while
documentation mentions logging levels, there is no code ensuring structured audit trails
for critical operations.

Referred Code
name: Gradle Build

on:
  push:
    branches: [ main, gradle-convert ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

jobs:
  build:
    runs-on: windows-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'


 ... (clipped 72 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status:
Ambiguous examples: Documentation and examples reference generic names like “file,” “version,” and “url”
without showing concrete identifier usage in code, making it unclear whether the
implemented build scripts follow meaningful naming conventions.

Referred Code
---

#### `generateHashFiles(File file)`

Generates hash files (MD5, SHA1, SHA256, SHA512) for a given file.

**Parameters**:
- `file` (File) - File to generate hashes for

**Returns**: `void`

**Creates**:
- `{file}.md5` - MD5 hash
- `{file}.sha1` - SHA1 hash
- `{file}.sha256` - SHA256 hash
- `{file}.sha512` - SHA512 hash

**Example**:
```groovy
def archive = file('build/output.7z')
generateHashFiles(archive)


 ... (clipped 35 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Weak failure handling: The docs specify that remote property loading returns empty properties and only logs a
warning without throwing, which may mask failures and does not demonstrate explicit
handling of null/empty or boundary cases in the new build logic.

Referred Code
**Error Handling**:
- Returns empty `Properties` object on failure
- Logs warning message
- Does not throw exceptions

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Unstructured logging: The documentation shows use of plain logger messages without structured formats and does
not include safeguards against logging sensitive data such as credentials or tokens during
downloads and environment inspection.

Referred Code
## Logging

### Log Levels

```groovy
logger.error("Error message")    // Always shown
logger.warn("Warning message")   // Shown by default
logger.lifecycle("Info message") // Shown by default
logger.info("Debug message")     // Use --info flag
logger.debug("Trace message")    // Use --debug flag

Usage

# Normal output
gradle release

# Verbose output
gradle release --info



 ... (clipped 6 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Input validation gaps: New docs describe accepting version strings and downloading from URLs but do not show
validation/sanitization of external inputs or protections against injection via parameters
or environment variables.

Referred Code
**Non-Interactive Mode**:
```bash
gradle release -PbundleVersion=2.51.2

Process:

  1. Version selection (interactive or parameter)
  2. Validate bundle path exists
  3. Download and extract Git binaries
  4. Prepare bundle directory
  5. Copy Git files (excluding docs)
  6. Copy custom configurations
  7. Replace version placeholders
  8. Create archive (7z or zip)
  9. Generate hash files

Output:

  • Archive: bearsampp-build/tools/git/{release}/bearsampp-git-{version}-{release}.7z
  • Hashes: .md5, .sha1, .sha256, .sha512

... (clipped 27 lines)


</details>

> Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a>
</details></td></tr>

<tr><td align="center" colspan="2">

 <!-- /compliance --update_compliance=true -->

</td></tr></tbody></table>
</details>

@qodo-code-review
Copy link

qodo-code-review bot commented Nov 12, 2025

PR Code Suggestions ✨

Latest suggestions up to 16084f4

CategorySuggestion                                                                                                                                    Impact
Possible issue
Align Gradle task names

Correct the Gradle task names in the workflow to match the documented and likely
implemented tasks (info instead of buildInfo, release instead of buildRelease,
and remove verifyBundle).

.github/workflows/gradle-build.yml [34-44]

 - name: Show build info
-  run: gradle buildInfo
+  run: gradle info
 
 - name: List available versions
   run: gradle listVersions
 
-- name: Verify bundle structure
-  run: gradle verifyBundle
+- name: Build release
+  run: gradle release
 
-- name: Build release
-  run: gradle buildRelease
-
  • Apply / Chat
Suggestion importance[1-10]: 10

__

Why: The suggestion correctly identifies that the workflow calls non-existent Gradle tasks (buildInfo, verifyBundle, buildRelease), which would cause the build to fail, and provides the correct task names based on the PR's documentation.

High
Fix artifact path location

Correct the artifact upload path to be within the GitHub workspace, as using ../
is not allowed by actions/upload-artifact and will cause the step to fail.

.github/workflows/gradle-build.yml [46-51]

 - name: Upload artifacts
   uses: actions/upload-artifact@v4
   with:
     name: bearsampp-git-release
-    path: ../bearsampp-build/tools/git/**/*.7z
+    path: bearsampp-build/tools/git/**/*.7z
     retention-days: 30
  • Apply / Chat
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies that the artifact path ../bearsampp-build is outside the GitHub workspace, which will cause the upload-artifact action to fail, thus breaking the workflow.

High
Verify 7-Zip installation path

After installing 7-Zip, add a step to verify that 7z.exe exists at the hardcoded
path before adding it to $env:GITHUB_PATH to make the workflow more robust.

.github/workflows/gradle-build.yml [29-32]

 - name: Install 7-Zip
+  shell: pwsh
   run: |
     choco install 7zip -y
-    echo "C:\Program Files\7-Zip" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+    $sevenZipPath = "C:\Program Files\7-Zip"
+    if (!(Test-Path "$sevenZipPath\7z.exe")) {
+      Write-Error "7z.exe not found at $sevenZipPath"
+      exit 1
+    }
+    "$sevenZipPath" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
  • Apply / Chat
Suggestion importance[1-10]: 5

__

Why: The suggestion improves the robustness of the workflow by adding a verification step to ensure 7z.exe is found at the expected path after installation, preventing potential downstream failures.

Low
Security
Pin action to commit SHA

Pin the gradle/gradle-build-action to a specific commit SHA instead of the v2
tag to enhance security and ensure deterministic builds.

.github/workflows/gradle-build.yml [24-27]

 - name: Setup Gradle
-  uses: gradle/gradle-build-action@v2
+  uses: gradle/gradle-build-action@f576353f17f0d46b38f9343e9fd9b7d9ff4cdfc6 # v2.12.0 (example pin)
   with:
     gradle-version: 8.5
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly recommends pinning the action to a commit SHA, which is a security best practice for GitHub Actions to ensure build reproducibility and mitigate supply-chain risks.

Medium
  • More

Previous suggestions

Suggestions up to commit a7e2fab
CategorySuggestion                                                                                                                                    Impact
Security
Pin action to commit SHA

Pin the gradle/gradle-build-action@v2 action to a specific commit SHA. This
prevents unexpected breaking changes or security vulnerabilities from upstream
updates.

.github/workflows/gradle-build.yml [24-27]

 - name: Setup Gradle
-  uses: gradle/gradle-build-action@v2
+  uses: gradle/gradle-build-action@31aa04e4c420c49203dea1c7d333da275a0f70e5 # v2.11.1
   with:
     gradle-version: 8.5
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly points out a security best practice for GitHub Actions by pinning the action to a specific commit SHA, which enhances the workflow's security and reliability.

Medium
Possible issue
Validate 7-Zip install and path

Make the 7-Zip installation step more robust. Add error checking after the choco
install command and verify the installation path exists before adding it to the
environment's PATH.

.github/workflows/gradle-build.yml [29-32]

 - name: Install 7-Zip
+  shell: pwsh
   run: |
-    choco install 7zip -y
-    echo "C:\Program Files\7-Zip" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+    choco install 7zip -y --no-progress
+    if ($LASTEXITCODE -ne 0) { throw "7-Zip installation failed via Chocolatey." }
+    $sevenZipPath = "C:\Program Files\7-Zip"
+    if (-not (Test-Path $sevenZipPath)) {
+      throw "7-Zip not found at expected path: $sevenZipPath"
+    }
+    "$sevenZipPath" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
Suggestion importance[1-10]: 6

__

Why: This suggestion improves the robustness of the 7-Zip installation step by adding explicit error handling and path validation, which prevents silent failures and makes the workflow more reliable.

Low
Suggestions up to commit 6d382b8
CategorySuggestion                                                                                                                                    Impact
Security
Pin action to commit SHA

Pin the gradle/gradle-build-action to a specific commit SHA instead of the v2
tag to improve the security and reliability of the workflow.

.github/workflows/gradle-build.yml [24-27]

 - name: Setup Gradle
-  uses: gradle/gradle-build-action@v2
+  # gradle/gradle-build-action@v2 (pinned)
+  uses: gradle/gradle-build-action@e5d8a05c7d0bd9d3b0c0fcb2a1c4b59f2b23a6d9
   with:
     gradle-version: 8.5
Suggestion importance[1-10]: 7

__

Why: This is a valid security best practice for GitHub Actions, enhancing supply-chain security by pinning the action to an immutable commit SHA instead of a mutable tag.

Medium
Possible issue
Verify 7-Zip install and path

Improve the 7-Zip installation step by verifying the executable's existence in
common paths and failing with a clear error if not found, instead of relying on
a hardcoded path.

.github/workflows/gradle-build.yml [29-32]

 - name: Install 7-Zip
+  shell: pwsh
   run: |
-    choco install 7zip -y
-    echo "C:\Program Files\7-Zip" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+    choco install 7zip -y --no-progress
+    $paths = @(
+      "C:\Program Files\7-Zip\7z.exe",
+      "C:\Program Files (x86)\7-Zip\7z.exe"
+    )
+    $sevenZip = $paths | Where-Object { Test-Path $_ } | Select-Object -First 1
+    if (-not $sevenZip) {
+      Write-Error "7-Zip not found after installation. Aborting."
+      exit 1
+    }
+    $sevenZipDir = Split-Path -Parent $sevenZip
+    "$sevenZipDir" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
Suggestion importance[1-10]: 6

__

Why: The suggestion improves the robustness of the workflow by dynamically finding the 7-Zip installation path and adding error handling, preventing potential failures if the installation path differs from the hardcoded value.

Low
Suggestions up to commit b1610f8
CategorySuggestion                                                                                                                                    Impact
Security
Pin GitHub Action to commit

Pin the gradle/gradle-build-action to a specific commit SHA instead of the
floating @v2 tag to improve security and ensure workflow immutability.

.github/workflows/gradle-build.yml [24-27]

 - name: Setup Gradle
-  uses: gradle/gradle-build-action@v2
+  uses: gradle/gradle-build-action@2e77d66e3d9a55a9bb0905f8d63a9cedf6de9c0f  # v2 pinned
   with:
     gradle-version: 8.5
Suggestion importance[1-10]: 8

__

Why: This suggestion correctly identifies a security risk with using a floating tag (@v2) and proposes pinning the action to a specific commit SHA, which is a best practice for supply-chain security.

Medium
Possible issue
Enforce artifact existence check

Add a step before uploading artifacts to verify that build output files (.7z)
exist, and fail the workflow if they are missing.

.github/workflows/gradle-build.yml [46-51]

+- name: Verify artifacts exist
+  shell: pwsh
+  run: |
+    $files = Get-ChildItem -Path "..\bearsampp-build\tools\git" -Recurse -Filter *.7z
+    if (-not $files) {
+      Write-Error "No .7z artifacts found under ..\bearsampp-build\tools\git"
+      exit 1
+    }
+    $files | ForEach-Object { Write-Host "Found artifact: $($_.FullName)" }
+
 - name: Upload artifacts
   uses: actions/upload-artifact@v4
   with:
     name: bearsampp-git-release
     path: ../bearsampp-build/tools/git/**/*.7z
     retention-days: 30
Suggestion importance[1-10]: 7

__

Why: This is a valuable improvement that makes the workflow more robust by ensuring it fails if the build process does not produce the expected artifacts, preventing misleading "successful" runs.

Medium
Harden 7-Zip installation verification

Harden the 7-Zip installation step by upgrading Chocolatey, installing 7-Zip,
and explicitly verifying that 7z.exe exists before adding its path to the
environment.

.github/workflows/gradle-build.yml [29-32]

 - name: Install 7-Zip
+  shell: pwsh
   run: |
-    choco install 7zip -y
-    echo "C:\Program Files\7-Zip" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+    choco feature enable -n=allowGlobalConfirmation
+    choco source list
+    choco upgrade chocolatey -y || echo "Chocolatey upgrade skipped"
+    choco install 7zip -y --no-progress
+    if (-not (Test-Path "C:\Program Files\7-Zip\7z.exe")) {
+      Write-Error "7z.exe not found after installation"
+      exit 1
+    }
+    "C:\Program Files\7-Zip" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
Suggestion importance[1-10]: 6

__

Why: The suggestion improves the reliability of the 7-Zip installation step by adding verification and safeguards against stale Chocolatey metadata, making the workflow more robust.

Low
General
Add concurrency and robust flags

Add a concurrency group to the workflow to prevent multiple workflow_dispatch
runs from executing simultaneously and interfering with each other.

.github/workflows/gradle-build.yml [85-86]

+concurrency:
+  group: build-all-${{ github.ref }}
+  cancel-in-progress: false
+
+# ...
 - name: Build all releases
-  run: gradle buildAllReleases --parallel --max-workers=2
+  run: ./gradlew buildAllReleases --parallel --max-workers=2 --stacktrace
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly identifies the risk of concurrent workflow_dispatch runs and proposes a concurrency group, which is a crucial fix to prevent race conditions and corrupted builds.

Medium
Suggestions up to commit e5f77c6
CategorySuggestion                                                                                                                                    Impact
Possible issue
Align workflow tasks with Gradle tasks

Update the Gradle task names in the workflow (buildInfo, buildRelease) to match
the new names (info, release) defined in the build script and documentation to
prevent build failures.

.github/workflows/gradle-build.yml [34-44]

 - name: Show build info
-  run: gradle buildInfo
+  run: gradle info
 
 - name: List available versions
   run: gradle listVersions
 
-- name: Verify bundle structure
-  run: gradle verifyBundle
+# Optional: keep only if verifyBundle exists in build script
+# - name: Verify bundle structure
+#   run: gradle verifyBundle
 
 - name: Build release
-  run: gradle buildRelease
+  run: gradle release -PbundleVersion=2.51.2
Suggestion importance[1-10]: 9

__

Why: This suggestion correctly identifies a critical issue where the workflow calls Gradle tasks with old names that were renamed in this PR, which would cause the CI build to fail.

High
Make dispatchable multi-version builds reliable

Refactor the build-all job to correctly build multiple versions. The current
implementation calls a non-existent task (buildAllReleases); it should instead
iterate over a list of versions and execute the release task for each.

.github/workflows/gradle-build.yml [85-86]

-- name: Build all releases
-  run: gradle buildAllReleases --parallel --max-workers=2
+on:
+  push:
+    branches: [ main, gradle-convert ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+    inputs:
+      versions:
+        description: 'Comma-separated versions to build (e.g., 2.50.1,2.51.2)'
+        required: true
+        default: '2.51.2'
 
+jobs:
+  build-all:
+    runs-on: windows-latest
+    if: github.event_name == 'workflow_dispatch'
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+    - name: Set up JDK 17
+      uses: actions/setup-java@v4
+      with:
+        java-version: '17'
+        distribution: 'temurin'
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: 8.5
+    - name: Ensure 7-Zip available
+      shell: pwsh
+      run: |
+        if (-not (Get-Command 7z.exe -ErrorAction SilentlyContinue)) {
+          choco install 7zip -y
+          echo "C:\Program Files\7-Zip" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+        }
+    - name: Build selected releases
+      shell: pwsh
+      run: |
+        $versions = "${{ github.event.inputs.versions }}".Split(',') | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne "" }
+        foreach ($v in $versions) {
+          Write-Host "Building $v..."
+          & gradle release "-PbundleVersion=$v"
+        }
+
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies that the build-all job calls a non-existent Gradle task (buildAllReleases) and would fail, proposing a valid fix to iterate through versions and call the correct release task.

High
Upgrade Gradle action to v3

Upgrade the gradle/gradle-build-action from the deprecated v2 to the current v3
to improve performance and reliability.

.github/workflows/gradle-build.yml [24-27]

 - name: Setup Gradle
-  uses: gradle/gradle-build-action@v2
+  uses: gradle/gradle-build-action@v3
   with:
     gradle-version: 8.5
Suggestion importance[1-10]: 6

__

Why: The suggestion correctly identifies the use of a deprecated GitHub Action and recommends upgrading to v3, which is a valid best practice for improving CI/CD reliability and performance.

Low
General
Avoid redundant 7-Zip installs

Make the 7-Zip installation step idempotent by first checking if it's already
available on the runner's PATH before attempting to install it with Chocolatey.

.github/workflows/gradle-build.yml [29-32]

-- name: Install 7-Zip
+- name: Ensure 7-Zip available
+  shell: pwsh
   run: |
-    choco install 7zip -y
-    echo "C:\Program Files\7-Zip" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+    if (-not (Get-Command 7z.exe -ErrorAction SilentlyContinue)) {
+      choco install 7zip -y
+      echo "C:\Program Files\7-Zip" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+    } else {
+      Write-Host "7-Zip already available on PATH."
+    }
Suggestion importance[1-10]: 5

__

Why: The suggestion correctly notes that GitHub runners often pre-install 7-Zip and proposes a more robust, idempotent installation step, which improves build speed and reliability.

Low
✅ Suggestions up to commit 7673cfc
CategorySuggestion                                                                                                                                    Impact
High-level
PR is premature; build logic is missing/incorrect

The PR is premature because the core build logic file (build.gradle.kts) is
missing. The GRADLE_TODO.md file confirms the implementation is incomplete,
contradicting claims of completion in other files and making the extensive
documentation unreliable.

Examples:

GRADLE_TODO.md [4-11]
The build.gradle.kts has been created but does NOT match the apache/bruno/consolez pattern.

## What's Missing
Based on your feedback, the build system should be:
1. **Interactive** - prompts user for input
2. **Synced with apache/bruno/consolez** - uses the same pattern/structure

## Action Required
GRADLE_CONVERSION.md [350-359]
The Gradle conversion is **complete and ready for production use**. The new build system:

- ✅ Implements all Ant features
- ✅ Adds new utility tasks
- ✅ Improves performance
- ✅ Enhances developer experience
- ✅ Provides comprehensive documentation
- ✅ Includes CI/CD integration

The migration provides significant benefits with minimal risk.

Solution Walkthrough:

Before:

// GRADLE_CONVERSION.md
## Conclusion
The Gradle conversion is **complete and ready for production use**.
...
**Status:** ✅ Complete
**Production Ready:** ✅ Yes

// GRADLE_TODO.md
## Current Status
The build.gradle.kts has been created but does NOT match the apache/bruno/consolez pattern.
## Current Implementation Issues
- ❌ Not interactive
- ❌ Doesn't match apache/bruno/consolez structure

After:

// The PR should be reworked to first provide the actual build logic.
// A correct PR would include:

// build.gradle.kts (The missing file)
plugins { base }
// ... properties and helper functions ...
tasks.register("buildRelease") {
  // ... actual, working build logic ...
}
tasks.register("listVersions") {
  // ... actual, working logic ...
}
// ... other tasks

// Documentation in .gradle-docs/ would be updated
// to reflect the *actual* implementation.
Suggestion importance[1-10]: 10

__

Why: The suggestion correctly identifies a critical, PR-wide flaw: the core build.gradle.kts is missing, and GRADLE_TODO.md explicitly contradicts the claim of completion, rendering the extensive documentation and CI changes invalid.

High
Possible issue
Correct the build artifact path

Correct the build artifact path in the build job from ../bearsampp-build to
bearsampp-build. The current path is incorrect for the GitHub Actions workspace
and will cause the artifact steps to fail.

.github/workflows/gradle-build.yml [46-59]

 - name: Upload artifacts
   uses: actions/upload-artifact@v4
   with:
     name: bearsampp-git-release
-    path: ../bearsampp-build/tools/git/**/*.7z
+    path: bearsampp-build/tools/git/**/*.7z
     retention-days: 30
 
 - name: Display build output
   run: |
     Write-Host "Build completed successfully!"
     Write-Host "Output files:"
-    Get-ChildItem ../bearsampp-build/tools/git/ -Recurse -Filter *.7z | ForEach-Object {
+    Get-ChildItem bearsampp-build/tools/git/ -Recurse -Filter *.7z | ForEach-Object {
       Write-Host "  - $($_.FullName) ($([math]::Round($_.Length / 1MB, 2)) MB)"
     }
Suggestion importance[1-10]: 9

__

Why: This suggestion corrects an invalid path for build artifacts in the CI workflow, which would cause the upload-artifact and Display build output steps to fail.

High
Fix artifact path in workflow

Correct the build artifact path in the build-all job from ../bearsampp-build to
bearsampp-build. The current path is incorrect and will cause the artifact
upload to fail.

.github/workflows/gradle-build.yml [88-93]

 - name: Upload all artifacts
   uses: actions/upload-artifact@v4
   with:
     name: bearsampp-git-all-releases
-    path: ../bearsampp-build/tools/git/**/*.7z
+    path: bearsampp-build/tools/git/**/*.7z
     retention-days: 30
Suggestion importance[1-10]: 9

__

Why: This suggestion corrects an invalid path for build artifacts in the build-all CI job, which would cause the upload-artifact step to fail.

High
Run Gradle in non-interactive mode

Add the --console=plain flag to the gradle buildRelease command. This prevents
Gradle from entering an interactive mode that would cause the CI job to hang.

.github/workflows/gradle-build.yml [43-44]

 - name: Build release
-  run: gradle buildRelease
+  run: gradle buildRelease --console=plain
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies that running gradle buildRelease without parameters will trigger an interactive prompt, causing the CI job to hang. Adding --console=plain is a crucial fix for CI execution.

High
Ensure non-interactive Gradle execution in CI

Add the --console=plain flag to the gradle buildAllReleases command. This
ensures the task runs non-interactively, which is a best practice for CI
environments.

.github/workflows/gradle-build.yml [85-86]

 - name: Build all releases
-  run: gradle buildAllReleases --parallel --max-workers=2
+  run: gradle buildAllReleases --parallel --max-workers=2 --console=plain
Suggestion importance[1-10]: 7

__

Why: This suggestion correctly recommends adding --console=plain for non-interactive execution in CI, which is a best practice. However, its impact is lower as the buildAllReleases task is less likely to be interactive.

Medium

@qodo-code-review
Copy link

qodo-code-review bot commented Nov 14, 2025

PR Reviewer Guide 🔍

(Review updated until commit 16084f4)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
🧪 No relevant tests
🔒 No security concerns identified
⚡ Recommended focus areas for review

Artifact Path Robustness

The upload-artifact steps reference a relative path outside the repo (../bearsampp-build/tools/git/**/*.7z). Verify that Gradle outputs to this exact location on the GitHub runner; otherwise uploads will silently find nothing. Consider using ${{ github.workspace }} or making the path within the workspace to avoid reliance on parent directories.

name: bearsampp-git-release
path: ../bearsampp-build/tools/git/**/*.7z
retention-days: 30
Gradle Task Names

Workflow runs tasks buildInfo, listVersions, verifyBundle, buildRelease, and buildAllReleases. Ensure these custom tasks exist and are correctly grouped; otherwise the workflow will fail. Consider adding --stacktrace --info for easier CI diagnostics.

  run: gradle buildInfo

- name: List available versions
  run: gradle listVersions

- name: Verify bundle structure
  run: gradle verifyBundle

- name: Build release
  run: gradle buildRelease

- name: Upload artifacts
7-Zip Installation Assumptions

The workflow installs 7-Zip via Chocolatey and appends C:\Program Files\7-Zip to PATH. Confirm that Chocolatey’s package installs to that path on windows-latest images; alternatively, rely on the default PATH entry created by choco or query the install location to avoid brittle path assumptions.

- name: Install 7-Zip
  run: |
    choco install 7zip -y
    echo "C:\Program Files\7-Zip" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

@jwaisner jwaisner merged commit e6f487d into main Nov 19, 2025
2 of 4 checks passed
@jwaisner jwaisner deleted the gradle-convert branch November 19, 2025 02:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants