-
Notifications
You must be signed in to change notification settings - Fork 178
refactor(rust): modularize tc_helper, add typed errors, surface task … #649
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
09040e1
0ded498
0549580
154318b
494c06e
78a3163
279de06
d8d7fb0
0534000
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| # Compiles the tc_helper Rust native library from source (instead of relying on | ||
| # the pre-built .so committed under android/app/src/main/jniLibs/) and then | ||
| # builds the production APK against the freshly-compiled library. | ||
| # | ||
| # This is the "proper" fix for stale committed binaries: the .so is regenerated | ||
| # from rust/ on every run, so it can never drift from the Rust source. Once this | ||
| # is green, the committed jniLibs/*.so can be git-ignored and purged from history. | ||
| # | ||
| # NOTE: This workflow has not yet been run on CI — action versions, the NDK | ||
| # version, and the cargo-ndk invocation are transcribed from a verified LOCAL | ||
| # build (macOS) and may need small adjustments on the first CI run. | ||
| # | ||
| # Both arm64-v8a and armeabi-v7a are built. taskchampion is configured with only | ||
| # the server-sync backend (see rust/Cargo.toml), so there's no aws-lc-sys — hence | ||
| # no cmake/ninja/bindgen/libclang toolchain needed; ring builds with just the | ||
| # Rust + NDK toolchain. | ||
| name: Build tc_helper (compile from source) | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| pull_request: | ||
| branches: [main, reports] | ||
| paths: | ||
| - "rust/**" | ||
| - "android/**" | ||
| - ".github/workflows/build-tc-helper.yml" | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: actions/setup-java@v4 | ||
| with: | ||
| distribution: "temurin" | ||
| java-version: "17" | ||
|
|
||
| # Android SDK + NDK. cargo-ndk reads ANDROID_NDK_HOME to find the toolchain. | ||
| - uses: android-actions/setup-android@v3 | ||
| - name: Install NDK | ||
| run: | | ||
| sdkmanager "ndk;26.1.10909125" | ||
| echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/26.1.10909125" >> "$GITHUB_ENV" | ||
|
|
||
| - name: Install Rust + Android targets + cargo-ndk | ||
| run: | | ||
| rustup toolchain install stable --profile minimal | ||
| rustup target add aarch64-linux-android armv7-linux-androideabi | ||
| cargo install cargo-ndk --version ^4 | ||
|
|
||
| - name: Compile tc_helper (arm64-v8a + armeabi-v7a) from source | ||
| working-directory: rust | ||
| run: | | ||
| cargo ndk -t arm64-v8a -t armeabi-v7a \ | ||
| -o ../android/app/src/main/jniLibs \ | ||
| build --release | ||
|
|
||
| - name: Show freshly-built libs | ||
| run: ls -lhR android/app/src/main/jniLibs/ | ||
|
|
||
| - uses: subosito/flutter-action@v2 | ||
| with: | ||
| flutter-version: "3.44.5" | ||
|
|
||
| - run: flutter pub get | ||
| - run: flutter build apk --release --flavor production | ||
|
Comment on lines
+62
to
+67
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🌐 Web query:
💡 Result: As of July 9, 2026, the latest stable version of the Flutter SDK is 3.44.5 [1][2]. This version is part of the Flutter 3.44 release series, which was officially released in May 2026 [3]. You can ensure you are on the latest stable version by running the following commands in your terminal [4][2]: $ flutter channel stable $ flutter upgrade Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the workflow around the referenced lines
FILE=".github/workflows/build-tc-helper.yml"
wc -l "$FILE"
sed -n '1,140p' "$FILE" | nl -ba | sed -n '45,90p'Repository: CCExtractor/taskwarrior-flutter Length of output: 250 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/build-tc-helper.yml"
# Show the relevant section with line numbers using tools likely available in the sandbox
awk 'NR>=45 && NR<=75 { printf "%4d %s\n", NR, $0 }' "$FILE"Repository: CCExtractor/taskwarrior-flutter Length of output: 1281 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/build-tc-helper.yml"
# Show the job header and early lines for timeout settings
awk 'NR>=1 && NR<=45 { printf "%4d %s\n", NR, $0 }' "$FILE"Repository: CCExtractor/taskwarrior-flutter Length of output: 2111 Add an explicit timeout to the build job. The workflow has no 🤖 Prompt for AI Agents |
||
|
|
||
| - uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: production-apk-from-source | ||
| path: build/app/outputs/flutter-apk/app-production-release.apk | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Set
persist-credentials: falseon checkout.The
actions/checkout@v4action persists theGITHUB_TOKENin.git/configby default. Since this workflow runs onpull_requestand checks out untrusted PR code, disabling credential persistence eliminates a potential token-exfiltration vector.🛡️ Proposed fix
📝 Committable suggestion
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 32-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Source: Linters/SAST tools