Skip to content

Update testlens#15595

Merged
koppor merged 1 commit into
mainfrom
koppor-patch-2
Apr 20, 2026
Merged

Update testlens#15595
koppor merged 1 commit into
mainfrom
koppor-patch-2

Conversation

@koppor

@koppor koppor commented Apr 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Testlens 1.8.0 was released one year ago - https://github.com/testlens-app/setup-testlens/releases/tag/v1.8.0

@calixtus report output issues at https://github.com/testlens-app/setup-testlens/issues

Steps to test

See CI passing

Checklist

  • I own the copyright of the code submitted and I license it under the MIT license
  • [/] I manually tested my changes in running JabRef (always required)
  • [/] I added JUnit tests for changes (if applicable)
  • [/] I added screenshots in the PR description (if change is visible to the user)
  • [/] I added a screenshot in the PR description showing a library with a single entry with me as author and as title the issue number
  • [/I described the change in CHANGELOG.md in a way that can be understood by the average user (if change is visible to the user)
  • [/] I checked the user documentation for up to dateness and submitted a pull request to our user documentation repository

@koppor koppor added the automerge PR is tagged with that label will be merged if workflows are green label Apr 20, 2026
@qodo-free-for-open-source-projects

qodo-free-for-open-source-projects Bot commented Apr 20, 2026

Copy link
Copy Markdown
Contributor

Review Summary by Qodo

Update TestLens to v1.8.0 and disable cache debug

✨ Enhancement

Grey Divider

Walkthroughs

Description 
• Update TestLens action from v1.7.0 to v1.8.0
• Disable Gradle build action cache debug logging
Diagram 
flowchart LR
  A["GitHub Actions Config"] -- "Update TestLens version" --> B["v1.8.0"]
  A -- "Disable cache debug" --> C["GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: false"]
Loading

Grey Divider

File Changes

1. .github/actions/setup-gradle/action.yml ⚙️ Configuration changes +2/-2

Update TestLens and disable cache debug logging

• Updated TestLens setup action from v1.7.0 to v1.8.0
• Changed GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED from true to false

.github/actions/setup-gradle/action.yml

Grey Divider

Qodo Logo

@qodo-free-for-open-source-projects

qodo-free-for-open-source-projects Bot commented Apr 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0)

Grey Divider


Remediation recommended

1. Unpinned action version 🐞 Bug ⛨ Security
Description 
The composite action references testlens-app/setup-testlens via a mutable tag (v1.8.0) instead
of a commit SHA, so the exact code executed in CI is not guaranteed to stay the same over time.
Workflows that call this composite action run it with write-capable GITHUB_TOKEN permissions,
amplifying the impact of any unexpected upstream action change.
Code

.github/actions/setup-gradle/action.yml[30]

+      uses: testlens-app/setup-testlens@v1.8.0
Evidence 
The composite action executes a third-party action by tag rather than commit SHA, which means the
referenced content is not cryptographically fixed. This composite action is used by CI workflows
(e.g., tests-code.yml) that grant actions: write and pull-requests: write, and the repo
already demonstrates SHA-pinning for other third-party actions (e.g.,
slidoapp/import-codesign-certs@<sha>), indicating SHA pinning is an accepted approach here.

.github/actions/setup-gradle/action.yml[23-31]
.github/workflows/tests-code.yml[26-55]
.github/workflows/binaries.yml[613-623]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow uses `testlens-app/setup-testlens@v1.8.0` (a tag), which does not guarantee a fixed commit for CI execution.

### Issue Context
This composite action is reused across multiple workflows, some of which run with elevated `GITHUB_TOKEN` permissions (e.g., `actions: write`, `pull-requests: write`).

### Fix
Update the `uses:` reference to a specific commit SHA for the `v1.8.0` release, and keep the human-readable version as a comment, e.g.:

```yml
- name: Setup TestLens
 uses: testlens-app/setup-testlens@<full_commit_sha> # v1.8.0
```

### Fix Focus Areas
- .github/actions/setup-gradle/action.yml[28-31]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Grey Divider

ⓘ The new review experience is currently in Beta. Learn more

Grey Divider

Qodo Logo

@koppor koppor enabled auto-merge April 20, 2026 18:58
@koppor koppor added this pull request to the merge queue Apr 20, 2026
@github-actions github-actions Bot added the status: to-be-merged PRs which are accepted and should go into the merge-queue. label Apr 20, 2026
Merged via the queue into main with commit 6e2fcb1 Apr 20, 2026
85 of 100 checks passed
@koppor koppor deleted the koppor-patch-2 branch April 20, 2026 19:37
Siedlerchr added a commit that referenced this pull request Apr 22, 2026
@Siedlerchr
Merge remote-tracking branch 'upstream/main' into fixnpe
6845209 
* upstream/main:
  Remove review-to-comment migration (#15609)
  Chore(deps): Bump com.uber.nullaway:nullaway in /versions (#15615)
  Chore(deps): Bump javafx from 26 to 26.0.1 in /versions (#15614)
  Update dependency org.openjfx:javafx-base to v26.0.1 (#15608)
  Chore(deps): Bump org.openrewrite.rewrite from 7.30.0 to 7.31.0 (#15602)
  OpenOffice Refactor subtasks (#15380)
  Chore(deps): Bump org.hisp.dhis:json-tree in /versions (#15606)
  Chore(deps): Bump com.autonomousapps:dependency-analysis-gradle-plugin (#15604)
  Chore(deps): Bump com.autonomousapps:dependency-analysis-gradle-plugin (#15605)
  Chore(deps): Bump org.openrewrite.recipe:rewrite-recipe-bom (#15603)
  Fix hash warning (#15596)
  Update testlens (#15595)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jabref-machine jabref-machine jabref-machine approved these changes

Assignees

No one assigned

Labels

automerge PR is tagged with that label will be merged if workflows are green dev: build-system dev: ci-cd status: to-be-merged PRs which are accepted and should go into the merge-queue.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@koppor @jabref-machine